CVE-2024-28153

Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability.

Score

CVSS 3.1 7.3 High

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2024-03-06

Last modified

2025-03-25

Weaknesses

CWE-79

Affected products

• Owasp Dependency-check (Jenkins)
• Jenkins Owasp Dependency-check Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2024/03/06/3
• https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3344