CVE-2021-21659

2021-05-2517:15:08

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CPENameOperatorVersion
urltrigger-pluginequrltrigger-0.5
urltrigger-pluginequrltrigger-0.16
urltrigger-pluginequrltrigger-0.4.1
urltrigger-pluginequrltrigger-0.43
urltrigger-pluginequrltrigger-0.37
urltrigger-pluginequrltrigger-0.28
urltrigger-pluginequrltrigger-0.25
urltrigger-pluginequrltrigger-0.4
urltrigger-pluginequrltrigger-0.7
urltrigger-pluginequrltrigger-0.36

Name	Operator	Version
urltrigger-plugin	eq	urltrigger-0.5
urltrigger-plugin	eq	urltrigger-0.16
urltrigger-plugin	eq	urltrigger-0.4.1
urltrigger-plugin	eq	urltrigger-0.43
urltrigger-plugin	eq	urltrigger-0.37
urltrigger-plugin	eq	urltrigger-0.28
urltrigger-plugin	eq	urltrigger-0.25
urltrigger-plugin	eq	urltrigger-0.4
urltrigger-plugin	eq	urltrigger-0.7
urltrigger-plugin	eq	urltrigger-0.36