CVE-2021-43577: XXE vulnerability in Jenkins OWASP Dependency-Check Plugin
Summary
CVE-2021-43577: XXE vulnerability in Jenkins OWASP Dependency-Check Plugin. Affects org.jenkins-ci.plugins:dependency-check-jenkins-plugin versions < 5.1.2. Fixed in 5.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OWASP Dependency-Check Plugin is a plugin for Jenkins, an open-source automation server. It is designed to scan project dependencies and identify known vulnerabilities. The plugin integrates with various dependency scanning tools and provides reports on potential security issues. However, versions 5.1.1 and earlier of the plugin do not configure their XML parser to prevent XML external entity (XXE) attacks. This vulnerability allows attackers who can control workspace contents to exploit a crafted XML file, potentially leading to the extraction of secrets from the Jenkins controller or server-side request forgery.
Vulnerability Detail
The XXE vulnerability in the OWASP Dependency-Check Plugin arises from the lack of proper configuration of the XML parser. By manipulating the workspace contents, an attacker can inject a specially crafted XML file that includes external entities. These entities can be used to extract sensitive information from the Jenkins controller or perform server-side request forgery attacks. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 5.6.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the plugin to the fixed version as soon as possible.
Conclusion
The XXE vulnerability in the Jenkins OWASP Dependency-Check Plugin (CVE-2021-43577) poses a significant risk to Jenkins installations. It allows attackers to exploit the XML parsing functionality and potentially extract sensitive information or perform server-side request forgery attacks. To mitigate this vulnerability, it is crucial to update the plugin to version 5.1.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:dependency-check-jenkins-plugin →
FAQ
The OWASP Dependency-Check Plugin is a Jenkins plugin that scans project dependencies for known vulnerabilities.
An XXE vulnerability allows attackers to exploit the XML parsing functionality of an application to read arbitrary files or execute remote requests.
This vulnerability could allow an attacker to extract sensitive information from the Jenkins controller or perform server-side request forgery attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
No, there is no known workaround for this vulnerability. It is essential to update the OWASP Dependency-Check Plugin to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:dependency-check-jenkins-plugin.
