EUVD-2026-80760
GHSA-5xjp-hc9r-qrrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Item/Configure permission
-
DeliveryInject script into Dependency-Check report CWE value
-
ExploitPayload stored unescaped in Jenkins UI
-
ExecutionVictim opens report page
-
PersistScript executes in victim's session
-
ImpactActions performed as higher-privileged user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated attacker with Jenkins Item/Configure permission on the OWASP Dependency-Check Plugin (version 5.6.4 or earlier) who can influence the CWE values in a Dependency-Check report; the malicious payload is stored and only triggers when a victim user loads the report page in the Jenkins UI (UI:R). Limiting factors: the attacker must already hold a non-trivial job-configuration privilege (rules out fully unauthenticated abuse), a second user must view the affected report for the script to fire, and only unpatched plugin versions ≤5.6.4 are affected. Impact scales with how many low-trust users are granted Item/Configure and whether administrators view the crafted reports. |
| Impact | This is a moderate-priority stored XSS, not a top-tier emergency, despite the 8.0 vendor CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H is inflated by Jenkins' conventional practice of scoring stored XSS as C:H/I:H/A:H with S:U; a stored XSS realistically yields partial, session-scoped impact rather than full compromise of confidentiality, integrity, and availability of the Jenkins controller. Two hard limiters constrain risk: PR:L means the attacker must already hold Item/Configure permission (a semi-trusted insider or a compromised job-configurer account), and UI:R means a victim must view the affected report page. No EPSS score, no CISA KEV listing, and no POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent (all point to authenticated, interaction-dependent, non-wormable abuse) - this is a genuine but bounded issue best handled on a normal patch cycle, prioritized higher where many low-trust users hold Item/Configure. |
| Exploit ScenarioDerived | An attacker holding Jenkins Item/Configure permission causes a Dependency-Check report to contain a crafted CWE value with an embedded script payload; because the plugin does not escape CWE values on the Jenkins UI, the payload is stored. When another user (e.g., a Jenkins administrator) views the report page, the script executes in their browser session, potentially performing actions or exfiltrating session context as that higher-privileged user. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Stored cross-site scripting in the Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier allows an authenticated user holding the Item/Configure permission to inject script into the Jenkins UI by way of CWE values that are rendered from Dependency-Check reports without escaping; the payload persists in the stored report and fires only when a victim later loads the affected report page (UI:R), so no unauthenticated or anonymous path exists. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so this is not confirmed actively exploited. Independent assessment rates this as a moderate-priority stored XSS rather than a top-tier emergency despite the 8.0 vendor score, since successful abuse requires a non-trivial job-configuration privilege, depends on a second user viewing the crafted report, and caps out at limited confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
RemediationAI
The primary fix is to upgrade the Jenkins OWASP Dependency-Check Plugin above 5.6.4 to the fixed release identified in the Jenkins Security Advisory 2026-09-16, SECURITY-3992 (https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3992); the exact patched version number was not confirmed in the supplied data, so verify it directly in that advisory rather than assuming a version, and use the Jenkins Plugin Manager or the Jenkins update center to apply it, restarting the controller afterward. Where the upgrade cannot be applied immediately, the most effective compensating control is to restrict the Item/Configure permission to a small, trusted set of administrators, since that permission is the documented prerequisite for planting the malicious CWE value; the trade-off is that delegated job configuration for build teams must be withdrawn, which may slow pipeline maintenance. A second control is to treat Dependency-Check report artifacts as untrusted input: validate or sanitize the CWE fields in the generated XML/JSON before publishing the report to Jenkins, and restrict who can supply report files to jobs that other users view. Administrators can also reduce the blast radius by deploying a Content-Security-Policy (for example via the Jenkins CSP configuration or a reverse proxy header) to block inline script execution on the controller UI, accepting that strict CSP may break some older plugin UI behavior and needs testing first. Finally, since exploitation requires a victim to open the crafted report page, avoid having high-privilege administrators browse reports produced by lower-trust jobs, and keep the Jenkins controller off untrusted networks; at time of analysis no public exploit code or confirmed in-the-wild activity has been identified, so these measures are precautionary rather than incident-response driven, and no vendor-released patch version should be assumed beyond what the advisory documents.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 improper neutralization of input during web page generation, realized as stored (persistent) XSS rather than reflected or DOM-based. Jenkins plugins typically render report content through Jelly/Groovy views and the Stapler request-routing layer on the Jenkins controller; the OWASP Dependency-Check Plugin parses Dependency-Check XML/JSON reports, extracts CWE identifiers from the findings, and injects those values into the report UI. Because the CWE field is written into the page without HTML escaping, a crafted CWE value embedded in a Dependency-Check report is stored with the build record and re-executed on every subsequent page load by any user who opens that report. The reported CPE (cpe:2.3:a:jenkins_project:jenkins_owasp_dependency-check_plugin:*:*:*:*:*:*:*:*) is version-unbounded by itself; the binding constraint comes from the description and EUVD ('0 <= 5.6.4'), meaning all releases up to and including 5.6.4 are affected. The CVSS vector confirms remote network reachability (AV:N), low privileges (PR:L) and user interaction (UI:R). Notably, the independent assessment changes scope (S:C) while reducing confidentiality and integrity to Low and availability to None, indicating the script executes in the context of the Jenkins controller UI and can affect resources beyond the plugin's own component, but that realistic impact is session/UI compromise of the viewing user rather than controller-wide code execution. The underlying plugin is a build-time software composition analysis (SCA) tool that consumes third-party report artifacts, which is precisely why the stored artifact contents must be treated as untrusted input.
Know when Jenkins Owasp Dependency Check Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Authenticated Item/Configure attacker (PR:L) needs a victim to view the report (UI:R); stored XSS crosses into the victim's browser context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Articles & Coverage 2
Executive ViewAI
The Jenkins OWASP Dependency-Check Plugin (5.6.4 and earlier) contains a stored cross-site scripting flaw that lets an authenticated user with Item/Configure permission plant malicious script inside a Dependency-Check report, which then executes for any colleague who later opens that report page. Because this plugin feeds the build pipeline that validates third-party software components, compromise could let an attacker hijack a Jenkins user's session and tamper with what security teams see, weakening the supply-chain controls leadership relies on. Access is limited to trusted job-configuration roles and no patch or public exploit currently exists, so this is a manageable but real exposure for teams running Jenkins.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the Item/Configure permission to the minimum trusted set of users; limit access to Dependency-Check report pages to those who need them; disable or uninstall the OWASP Dependency-Check Plugin where it is not operationally required; audit existing stored reports for injected or unexpected script content; and review Jenkins user accounts for signs of session abuse after any suspicious report viewing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB