CVE-2021-21669: XEE
First published: Fri Jun 18 2021(Updated: )
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Generic Webhook Trigger | <=1.72 | |
| maven/org.jenkins-ci.plugins:generic-webhook-trigger | <=1.72 | 1.74 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/06/18/1
- https://www.jenkins.io/security/advisory/2021-06-18/#SECURITY-2330
- https://nvd.nist.gov/vuln/detail/CVE-2021-21669
- https://plugins.jenkins.io/generic-webhook-trigger/#dependencies
- https://github.com/jenkinsci/generic-webhook-trigger-plugin/commit/da434dfca1b82f5de81e29438762370d652493b8
- https://github.com/advisories/GHSA-732f-w585-gmpc (Advisory)
Frequently Asked Questions
What is CVE-2021-21669?
CVE-2021-21669 is a vulnerability in the Jenkins Generic Webhook Trigger Plugin 1.72 and earlier that allows XML external entity (XXE) attacks.
What is the severity of CVE-2021-21669?
CVE-2021-21669 has a severity rating of 9.8 (Critical).
How does CVE-2021-21669 affect Jenkins?
CVE-2021-21669 affects Jenkins instances running the Generic Webhook Trigger Plugin version 1.72 and earlier, allowing attackers to perform XML external entity (XXE) attacks.
What are the affected versions of the Generic Webhook Trigger Plugin?
The affected versions of the Generic Webhook Trigger Plugin are 1.72 and earlier.
How can I fix CVE-2021-21669?
To fix CVE-2021-21669, upgrade the Generic Webhook Trigger Plugin to version 1.74 or later.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-732f-w585-gmpc
- alias/CVE-2021-21669
- collector/github-advisory
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins generic webhook trigger
- version/jenkins generic webhook trigger/1.72
- package-manager/maven