GHSA-hr8p-76q8-fxwq

XXE vulnerability in Jenkins Performance Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21701

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:performance	<= 3.20	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21701 advisory
https://github.com/jenkinsci/performance-plugin package
https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2394 web
https://www.zerodayinitiative.com/advisories/ZDI-21-1313 web
http://www.openwall.com/lists/oss-security/2021/11/12/1 web