CVE-2021-21657

CVE-2021-21657 affects Jenkins Filesystem Trigger Plugin up to version 0.40. The root cause is that the plugin’s XML parser does not disable external entity resolution, enabling XXE attacks. Impact statements from multiple sources describe potential extraction of secrets from the Jenkins controll...