CVE-2021-21659: Jenkins URLTrigger Plugin XML parser allows XXE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.1 with high confidentiality and availability impact plus a very high EPSS percentile, though no KEV listing or confirmed exploitation.

What it is

The Jenkins URLTrigger Plugin through 0.48 does not configure its XML parser to block XML external entity (XXE) processing. An attacker who can influence the XML the plugin parses can cause the parser to resolve external entities, exposing local files or internal services. The flaw matters because Jenkins controllers often hold credentials and reach internal networks, so file disclosure or SSRF from the controller is high value.

Impact

An attacker gains read access to files on the Jenkins controller and can make the controller issue requests to internal or external systems (SSRF). The CVSS vector rates confidentiality and availability impact as high, so data exposure and denial of service are both plausible.

Attack surface

Reached over the network through the plugin's XML parsing path, which is triggered by URLTrigger build triggers processing XML content. The CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so an authenticated user with permission to configure or trigger the affected job is the likely entry point.

Exploitation

Not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded. EPSS is high (0.66774, 99.255th percentile), indicating elevated predicted likelihood, and references are vendor and third-party advisories only, with no public exploit tag.

What to do

• Upgrade the Jenkins URLTrigger Plugin to a version after 0.48 that disables external entity resolution, per the Jenkins security advisory 2021-05-25 (SECURITY-2341).
• If immediate upgrade is not possible, disable or remove the URLTrigger plugin from jobs until patched.
• Restrict job configuration and build trigger permissions to trusted users only, since the vector requires low privileges.
• Run the Jenkins controller with least privilege and limit its network reachability to internal services to reduce SSRF and file-disclosure impact.
• Review Jenkins controller file permissions and stored credentials for exposure if compromise is suspected.

Detection

• Search Jenkins logs and job configuration for URLTrigger usage and unexpected XML parsing errors or entity resolution warnings.
• Monitor controller outbound network connections to unusual internal hosts or file:// style access patterns from the Jenkins process.
• Audit Jenkins access logs for users with job configure or trigger permissions making unusual URLTrigger changes.
• Check for reads of sensitive controller files (for example credentials.xml or secrets) by the Jenkins process outside normal operation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.