Skip to content
OpenAdvisories
Critical · 9.8 CVE-2021-21669 EUVD-2022-2896GHSA-732f-w585-gmpc

XXE vulnerability in Jenkins Generic Webhook Trigger Plugin

Published Jun 18, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Generic Webhook Trigger Plugin Package: org.jenkins-ci.plugins:generic-webhook-trigger Category: Web / CMS Ecosystem: Maven

Description

Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Generic Webhook Trigger Plugin unspecified – ≤ 1.72 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:generic-webhook-trigger < 1.74 1.74 GHSA-732f-w585-gmpc

References