XXE vulnerability in Jenkins URLTrigger Plugin

HIGH 8.1CVE-2021-21659 · GHSA-34j5-c4cv-mmg5 · Published 25/05/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:urltrigger Maven	`< 0.49`	`0.49`
urltrigger jenkins	`≤ 0.48`	No fix yet

Description

Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Job/Configure permission or otherwise able to control the contents of an URL to an XML document being examined for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.

UJenkins RLTrigger Plugin 0.49 disables external entity resolution for its XML parser.

NVD description

Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

References

nvd.nist.gov/vuln/detail/CVE-2021-21659 · ADVISORY
jenkinsci/urltrigger-plugin · PACKAGE
jenkins.io/security/advisory/2021-05-25 · WEB
openwall.com/lists/oss-security/2021/05/25/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free