CVE-2021-43576

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

• CWE-611

• http://www.openwall.com/lists/oss-security/2021/11/12/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1314/Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2021/11/12/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1314/Third Party Advisory, VDB Entry

Published

Nov 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43570The verify function in the Stark Bank Java ECDSA library (ec…9.8
• CVE-2021-43571The verify function in the Stark Bank Node.js ECDSA library …9.8
• CVE-2021-43572The verify function in the Stark Bank Python ECDSA library (…9.8
• CVE-2021-43573A buffer overflow was discovered on Realtek RTL8195AM device…9.8
• CVE-2021-43574WebAdmin Control Panel in Atmail 6.5.0 (a version released i…6.1
• CVE-2021-43575KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Pass…5.5
• CVE-2021-43577Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does…7.1
• CVE-2021-43578Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 an…8.1
• CVE-2021-43579A stack-based buffer overflow in image_load_bmp() in HTMLDOC…7.8
• CVE-2021-4358The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable…6.1
• CVE-2021-43581An Out-of-Bounds Read vulnerability exists when reading a U3…8.8
• CVE-2021-43582A Use-After-Free Remote Vulnerability exists when reading a …7.8