CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2021-43576
Medium (6.5) in jenkins pom2config. EPSS 2.4% chance of exploitation in the next 30 days.
Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Severity
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:pom2config
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ppv9-v43c-xqpp | Maven | org.jenkins-ci.plugins:pom2config | <=1.2 | no fix published |