EUVD-2026-80760
GHSA-5xjp-hc9r-qrrp
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Authenticated Item/Configure attacker (PR:L) needs a victim to view the report (UI:R); stored XSS crosses into the victim's browser context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier allows an authenticated user holding the Item/Configure permission to inject script into the Jenkins UI by way of CWE values that are rendered from Dependency-Check reports without escaping; the payload persists in the stored report and fires only when a victim later loads the affected report page (UI:R), so no unauthenticated or anonymous path exists. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so this is not confirmed actively exploited. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated attacker with Jenkins Item/Configure permission on the OWASP Dependency-Check Plugin (version 5.6.4 or earlier) who can influence the CWE values in a Dependency-Check report; the malicious payload is stored and only triggers when a victim user loads the report page in the Jenkins UI (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority stored XSS, not a top-tier emergency, despite the 8.0 vendor CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade the Jenkins OWASP Dependency-Check Plugin above 5.6.4 to the fixed release identified in the Jenkins Security Advisory 2026-09-16, SECURITY-3992 (https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3992); the exact patched version number was not confirmed in the supplied data, so verify it directly in that advisory rather than assuming a version, and use the Jenkins Plugin Manager or the Jenkins update center to apply it, restarting the controller afterward. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Jenkins instance running the OWASP Dependency-Check Plugin at version 5.6.4 or earlier and confirm which users and groups hold the Item/Configure permission, tightening that permission to the smallest trusted set. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today