jenkins urltrigger vulnerabilities

Latest jenkins urltrigger CVEs

Newest publication first

1. CVE-2021-21659 XXE vulnerability in Jenkins URLTrigger Plugin

   Published 2021-05-25

   High·CVSS 8.1 EPSS 66.8%

   Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

2. CVE-2018-1000606 URLTrigger Plugin server-side request forgery vulnerability

   Published 2018-06-26

   Medium·CVSS 6.5 EPSS 0.70%

   A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.