CVE-2021-43577

HIGH

Jenkins OWASP Dependency-Check Plugin <5.1.1 - XXE

Title source: llm

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Core 2

Core References

Vendor Advisory x_refsource_confirm

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

CVSS v3 7.1

EPSS 0.0012

EPSS Percentile 30.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-611

Status published

Products (2)

jenkins/owasp_dependency-check < 5.1.1

org.jenkins-ci.plugins/dependency-check-jenkins-plugin 0 - 5.1.2Maven

Published Nov 12, 2021

Tracked Since Feb 18, 2026