CVE-2021-21642: XEE
A flaw was found in the config-file-provider Jenkins plugin. The plugin XML parser wasn't configure to prevent XML external entity (XXE) attacks. An attacker with the ability to define Maven configuration files can use this vulnerability to prepare a crafted configuration file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Other sources
Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with the ability to define Maven configuration files to have Jenkins parse a crafted configuration file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
— Red Hat
Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-21642?
CVE-2021-21642 is a vulnerability in the Jenkins Config File Provider Plugin that allows for XML external entity (XXE) attacks.
How severe is CVE-2021-21642?
CVE-2021-21642 has a severity rating of 8.1 (high).
Which software versions are affected by CVE-2021-21642?
Jenkins Config File Provider Plugin versions 3.7.0 and earlier are affected by CVE-2021-21642.
How can I fix CVE-2021-21642?
To fix CVE-2021-21642, upgrade to version 3.7.1 of the Jenkins Config File Provider Plugin.
Where can I find more information about CVE-2021-21642?
More information about CVE-2021-21642 can be found on the Jenkins.io and Red Hat websites.