PT-2021-14702 · Jenkins · Jenkins Urltrigger Plugin+1

Kevin Guerroudj · Published 2021-05-25 · Updated 2023-10-25 · CVE-2021-21659

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jenkins URLTrigger Plugin versions 0.48 and earlier

Description The issue allows attackers with Job/Configure permission or those able to control the contents of a URL to an XML document being examined for changes to have Jenkins parse a crafted XML document. This can lead to extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks. The problem arises because the XML parser is not configured to prevent XML external entity (XXE) attacks.

Recommendations For Jenkins URLTrigger Plugin versions 0.48 and earlier, update to version 0.49 or later, which disables external entity resolution for its XML parser.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-21659

GHSA-34J5-C4CV-MMG5

Affected Products

Jenkins

Jenkins Urltrigger Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-21659 · Security Note
• https://jenkins.io/security/advisory/2021-05-25/#SECURITY-2341 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-34j5-c4cv-mmg5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21659 · Vendor Advisory
• https://github.com/jenkinsci/urltrigger-plugin · Note
• http://openwall.com/lists/oss-security/2021/05/25/3 · Note