org.jenkins-ci.plugins:xtrigger (>=0.1 <=0.54) potentially affected by CVE-2021-21657 via org.jenkins-ci.plugins:fstrigger (>=0.10.1 <=0.34)

org.jenkins-ci.plugins:fstrigger MAVEN version =0.10.1, =0.1, =0.54 Source cves: CVE-2021-21657 Source advisory: OSV:GHSA-CPHV-7CXW-5HCC...

XXE vulnerability in fstrigger

fstrigger 0.40 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Job/Configure permission or otherwise able to control the contents of an XML file being polled for changes to have Jenkins parse a crafted XML document that uses...