CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.5. It affects Jenkins.
CVE
CVE-2021-43576
Severity
MEDIUM
CVSS
6.5
EPSS
2.37%
Jenkins
Original NVD Description
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Related CVEs
Other vulnerabilities affecting the same vendor(s)