PT-2021-14715 · Jenkins · Jenkins Selenium Html Report Plugin+1

Justin Philip + 2 · Published 2021-06-30 · Updated 2023-10-25 · CVE-2021-21672

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Selenium HTML report Plugin versions 1.0 and earlier

Description The issue arises from the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks, allowing attackers who can control the report files parsed by this plugin to craft a report file that uses external entities. This can lead to the extraction of secrets from the Jenkins controller or server-side request forgery.

Recommendations For Jenkins Selenium HTML report Plugin versions 1.0 and earlier, update to version 1.1 or later, which disables external entity resolution for its XML parser.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-21672

GHSA-HXXP-6546-WV6R

Affected Products

Jenkins

Jenkins Selenium Html Report Plugin

References · 11

• https://jenkins.io/security/advisory/2021-06-30/#SECURITY-2329 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hxxp-6546-wv6r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21672 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21672 · Vendor Advisory
• https://github.com/jenkinsci/seleniumhtmlreport-plugin · Note
• https://github.com/jenkinsci/seleniumhtmlreport-plugin/commit/5ca59b8c7d23af4450dc7f19c1b4107d59063ae1 · Note
• http://openwall.com/lists/oss-security/2021/06/30/1 · Note
• https://t.me/cvenotify/16944 · Telegram Post
• http://openwall.com/lists/oss-security/2022/04/14/2 · Note
• https://t.me/cibsecurity/25832 · Telegram Post
• https://t.me/cvenotify/17159 · Telegram Post