Skip to content
OpenAdvisories
High · 7.1 CVE-2021-21680 EUVD-2022-2664GHSA-5wc4-w63v-97c3

XXE vulnerability in Jenkins Nested View Plugin

Published Aug 31, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Nested View Plugin Package: org.jenkins-ci.plugins:nested-view Category: Web / CMS Ecosystem: Maven

Description

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Nested View Plugin unspecified – ≤ 1.20 1.19.1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:nested-view < 1.21 1.21 GHSA-5wc4-w63v-97c3

References