Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21680

CVE-2021-21680: XXE vulnerability in Jenkins Nested View Plugin

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21680
GHSA ID
GHSA-5wc4-w63v-97c3
EPSS Score
0.84441%
CWE
CWE-611
Published
5/24/2022
Updated
12/7/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:nested-viewmaven<= 1.201.21

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure XML processing in the updateByXml method. The pre-patch code directly used TransformerFactory.newInstance().newTransformer() without security settings, leaving XXE protections disabled. The fix explicitly adds security features (FEATURE_SECURE_PROCESSING and access restrictions), confirming this was the vulnerable code path. The method's purpose of processing XML input from view configurations matches the attack vector described in advisories.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins N*st** Vi*w Plu*in *.** *n* **rli*r *o*s not *on*i*ur* its XML tr*ns*orm*r to pr*v*nt XML *xt*rn*l *ntity (XX*) *tt**ks. T*is *llows *tt**k*rs **l* to *on*i*ur* vi*ws to **v* J*nkins p*rs* * *r**t** vi*w XML ***inition t**t us*s *xt*rn*l *nt

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* XML pro**ssin* in t** up**t**yXml m*t*o*. T** pr*-p*t** *o** *ir**tly us** Tr*ns*orm*r***tory.n*wInst*n**().n*wTr*ns*orm*r() wit*out s**urity s*ttin*s, l**vin* XX* prot**tions *is**l**. T** *ix *xpli*itly ***s s*