CVE-2021-21669
XXE vulnerability in Jenkins Generic Webhook Trigger Plugin
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2021-21669- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2021-21669- Updated
- 2026-11-02
EUVDEUVD-2022-2896 No score
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
EUVD-2022-2896- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-732f-w585-gmpc
XXE vulnerability in Jenkins Generic Webhook Trigger Plugin
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins Generic Webhook Trigger Plugin 1.74 disables external entity resolution for its XML parser.
- Record
GHSA-732f-w585-gmpc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-732f-w585-gmpc
XXE vulnerability in Jenkins Generic Webhook Trigger Plugin
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins Generic Webhook Trigger Plugin 1.74 disables external entity resolution for its XML parser.
- Record
GHSA-732f-w585-gmpc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:generic-webhook-triggerMaven |
through 1.72 | 1.74 |
org.jenkins-ci.plugins:generic-webhook-triggerMaven |
before 1.74, plus listed versions 0.1.01.01.11.101.11 Show 45 moreShow less1.121.131.141.151.161.171.181.191.21.201.211.221.231.241.251.261.271.281.291.31.301.311.321.331.341.351.361.371.381.391.41.401.411.421.431.441.451.461.471.481.491.51.501.511.52 |
1.74 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21669 is a critical vulnerability (CVSS 9.8) in Jenkins Generic Webhook Trigger, published June 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 25.7%, the 97th percentile. Fixed in org.jenkins-ci.plugins:generic-webhook-trigger 1.74.
References
jenkins.io/security/advisory/2021-06-18
openwall.com/lists/oss-security/2021/06/18/1
nvd.nist.gov/vuln/detail/CVE-2021-21669
plugins.jenkins.io/generic-webhook-trigger
github.com/jenkinsci/generic-webhook-trigger-plugin/commit/da434dfca1b82f5de81e29438762370d652493b8
Left out here: 23 versions. The JSON record has them.