CVE-2021-21642: 
Java vulnerability analysis and mitigation

CVE-2021-21642 (SECURITY-2204) is a vulnerability discovered in Jenkins Config File Provider Plugin versions 3.7.0 and earlier. The vulnerability stems from the plugin's failure to configure its XML parser to prevent XML external entity (XXE) attacks. This security issue was disclosed on April 21, 2021, affecting the Config File Provider Plugin, a component of the Jenkins automation server (Jenkins Advisory).

The vulnerability is classified as High severity according to CVSS scoring. The core issue lies in the XML parser configuration of the Config File Provider Plugin, which does not properly prevent XML external entity (XXE) attacks in versions 3.7.0 and earlier. The vulnerability specifically affects the plugin's handling of Maven configuration files (Jenkins Advisory).

The vulnerability allows attackers with the ability to define Maven configuration files to have Jenkins parse a crafted configuration file that uses external entities. This can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery attacks (Jenkins Advisory, OSS Security).

The vulnerability was fixed in Config File Provider Plugin version 3.7.1, which disables external entity resolution for its XML parser. Users are strongly advised to upgrade to this version or later to mitigate the vulnerability (Jenkins Advisory).