Lucene search
GoogleOSV:GHSA-PPV9-V43C-XQPPHistoryMay 24, 2022 - 7:20 p.m.
XXE vulnerability in Jenkins pom2config Plugin
2022-05-2419:20:33
Google
osv.dev
8
0.005 Low
EPSS
Percentile
76.2%
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
As of publication of this advisory, there is no fix.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.jenkins-ci.plugins:pom2config | eq | 1.2 |
Related
zdi
zdi
cvelist
cvelist
CVE-2021-43576
2021-11-12 10:35:20
cnvd
cnvd
Jenkins code issue vulnerability (CNVD-2021-93372)
2021-11-17 00:00:00
cve
cve
CVE-2021-43576
2021-11-12 11:15:08
nvd
nvd
CVE-2021-43576
2021-11-12 11:15:08
prion
prion
Server side request forgery (ssrf)
2021-11-12 11:15:00
github
github
XXE vulnerability in Jenkins pom2config Plugin
2022-05-24 19:20:33