Launchpad.net

CVE 2021-21642

Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

See the CVE page on Mitre.org for more details.