Not rated
CVE-2021-43576 Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE)…
Description
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins pom2config Plugin 1.2 | earliest → 1.2 | No fix stated |