Skip to content
OpenAdvisories
High · 8.1 CVE-2021-21659 EUVD-2022-2106GHSA-34j5-c4cv-mmg5

XXE vulnerability in Jenkins URLTrigger Plugin

Published May 25, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins URLTrigger Plugin Package: org.jenkins-ci.plugins:urltrigger Category: Web / CMS Ecosystem: Maven

Description

Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins URLTrigger Plugin unspecified – ≤ 0.48 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:urltrigger < 0.49 0.49 GHSA-34j5-c4cv-mmg5

References