CVE-2021-43576 XXE vulnerability in Jenkins pom2config Plugin
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2021-43576?
CVE-2021-43576 is a medium-severity vulnerability in Jenkins pom2config Plugin, published on 12 Nov 2021.
Official description
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Weakness: CWE-611
Which versions are affected by CVE-2021-43576?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:pom2config. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:pom2config Maven | All versions to 1.2 | None |
org.jenkins-ci.plugins:pom2config Maven | All versions to 1.2 | None |
Products include Jenkins Pom2config.
How do I fix CVE-2021-43576?
No fix has been published for CVE-2021-43576 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-43576 being exploited?
There is no known exploitation of CVE-2021-43576 in the wild and no public exploit code.
Sources
Also known as GHSA-ppv9-v43c-xqpp.