CVE-2021-21672: XXE vulnerability in Jenkins Selenium HTML report Plugin
Summary
CVE-2021-21672: XXE vulnerability in Jenkins Selenium HTML report Plugin. Affects org.jenkins-ci.plugins:seleniumhtmlreport versions < 1.1. Fixed in 1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Selenium HTML report Plugin is a Maven package that provides functionality for generating HTML reports for Selenium tests in Jenkins. It allows users to view detailed reports of their test results. However, versions 1.0 and earlier of this plugin are vulnerable to an XML external entity (XXE) attack.
Vulnerability Detail
The XXE vulnerability in the Jenkins Selenium HTML report Plugin allows attackers who can control the report files parsed by the plugin to exploit external entities for extracting sensitive information from the Jenkins controller. This can lead to server-side request forgery and potential exposure of secrets. The vulnerability has been assigned a CVSS score of 7.1, indicating a high severity.
How To Fix
Minimum fixed version
1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The XXE vulnerability in the Jenkins Selenium HTML report Plugin poses a significant risk to the security of Jenkins installations. It is recommended to upgrade to version 1.1 or later of the plugin to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:seleniumhtmlreport →
FAQ
The vulnerability allows attackers to extract sensitive information from the Jenkins controller and potentially perform server-side request forgery.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file to the playground for real-time monitoring and alerts.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the patched version of the plugin.
There is no evidence of active exploits at the moment. However, it is crucial to apply the necessary patches to prevent potential attacks.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/advisories/GHSA-hxxp-6546-wv6r.
