Skip to content
OpenAdvisories
High · 7.1 CVE-2021-43577 EUVD-2022-4575GHSA-mj5v-ggjc-48p5

XXE vulnerability in Jenkins OWASP Dependency-Check Plugin

Published Nov 12, 2021 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins OWASP Dependency-Check Plugin Package: org.jenkins-ci.plugins:dependency-check-jenkins-plugin Category: Web / CMS Ecosystem: Maven

Description

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins OWASP Dependency-Check Plugin unspecified – ≤ 5.1.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:dependency-check-jenkins-plugin < 5.1.2 5.1.2 GHSA-mj5v-ggjc-48p5

References