CVE-2021-21642
Description
Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
References
Vendor Advisory
Mailing ListThird Party Advisory
CvssV3 impact
BaseSeverity | HIGH |
ConfidentialityImpact | HIGH |
AttackComplexity | LOW |
Scope | UNCHANGED |
AttackVector | NETWORK |
AvailabilityImpact | NONE |
IntegrityImpact | HIGH |
PrivilegesRequired | LOW |
BaseScore | 8.1 |
VectorString | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Version | 3.1 |
UserInteraction | NONE |
CvssV2 impact
AccessComplexity | LOW |
ConfidentialityImpact | PARTIAL |
AvailabilityImpact | NONE |
IntegrityImpact | PARTIAL |
BaseScore | 5.5 |
VectorString | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Version | 2.0 |
AccessVector | NETWORK |
Authentication | SINGLE |