GHSA-5wc4-w63v-97c3

XXE vulnerability in Jenkins Nested View Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2021-21680

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:nested-view	< 1.21	1.21

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks. This allows attackers able to configure views to have Jenkins parse a crafted view XML definition that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Jenkins Nested View Plugin 1.21 disables external entity resolution for its XML transformer.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21680 advisory
https://github.com/jenkinsci/nested-view-plugin/commit/79787294f034b3009c3de557c6441c9ceba936b8 web
https://github.com/jenkinsci/nested-view-plugin package
https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2411 web
http://www.openwall.com/lists/oss-security/2021/08/31/1 web