What is GHSA-5wc4-w63v-97c3?

GHSA-5wc4-w63v-97c3 is a security advisory published by GitHub Security Advisories with High severity. XXE vulnerability in Jenkins Nested View Plugin

Which CVE IDs does GHSA-5wc4-w63v-97c3 cover?

GHSA-5wc4-w63v-97c3 covers the following CVE IDs: CVE-2021-21680. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5wc4-w63v-97c3?

GHSA-5wc4-w63v-97c3 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-5wc4-w63v-97c3?

GHSA-5wc4-w63v-97c3 affects 1 product, including: maven/org.jenkins-ci.plugins:nested-view:\u003c= 1.20.

GHSA-5wc4-w63v-97c3HighCVSS 7.1

XXE vulnerability in Jenkins Nested View Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 7, 2023

🔗 CVE IDs covered (1)

CVE-2021-21680 →

📋 Description

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.

This allows attackers able to configure views to have Jenkins parse a crafted view XML definition that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Jenkins Nested View Plugin 1.21 disables external entity resolution for its XML transformer.

🎯 Affected products1

maven/org.jenkins-ci.plugins:nested-view:<= 1.20

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-21680
https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2411
http://www.openwall.com/lists/oss-security/2021/08/31/1
https://github.com/jenkinsci/nested-view-plugin/commit/79787294f034b3009c3de557c6441c9ceba936b8
https://github.com/advisories/GHSA-5wc4-w63v-97c3