CVE-2021-21657

Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2021-21657

CVE-2021-21657 affects Jenkins Filesystem Trigger Plugin up to version 0.40. The root cause is that the plugin’s XML parser does not disable external entity resolution, enabling XXE attacks. Impact statements from multiple sources describe potential extraction of secrets from the Jenkins controll...