PT-2021-23881 · Jenkins · Jenkins Pom2Config Plugin+1

Adith Sudhakar · Published 2021-11-12 · Updated 2023-11-22 · CVE-2021-43576

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins pom2config Plugin versions 1.2 and earlier

Description The issue allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is due to the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks.

Recommendations For Jenkins pom2config Plugin versions 1.2 and earlier: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the plugin or disabling the XML parser to minimize the risk of exploitation.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-43576

GHSA-PPV9-V43C-XQPP

ZDI-21-1314

Affected Products

Jenkins

Jenkins Pom2Config Plugin

References · 10

• https://zerodayinitiative.com/advisories/ZDI-21-1314 · Security Note
• https://jenkins.io/security/advisory/2021-11-12/#SECURITY-2415 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ppv9-v43c-xqpp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43576 · Security Note
• https://github.com/jenkinsci/pom2config-plugin · Note
• https://t.me/cvenotify/23330 · Telegram Post
• http://openwall.com/lists/oss-security/2021/11/12/1 · Note
• https://t.me/cvenotify/23324 · Telegram Post
• https://t.me/cibsecurity/32295 · Telegram Post