Jenkins Owasp Dependency Check Plugin
Monthly
Stored cross-site scripting in the Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier allows an authenticated user holding the Item/Configure permission to inject script into the Jenkins UI by way of CWE values that are rendered from Dependency-Check reports without escaping; the payload persists in the stored report and fires only when a victim later loads the affected report page (UI:R), so no unauthenticated or anonymous path exists. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so this is not confirmed actively exploited. Independent assessment rates this as a moderate-priority stored XSS rather than a top-tier emergency despite the 8.0 vendor score, since successful abuse requires a non-trivial job-configuration privilege, depends on a second user viewing the crafted report, and caps out at limited confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in the Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier allows an authenticated user holding the Item/Configure permission to inject script into the Jenkins UI by way of CWE values that are rendered from Dependency-Check reports without escaping; the payload persists in the stored report and fires only when a victim later loads the affected report page (UI:R), so no unauthenticated or anonymous path exists. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV, so this is not confirmed actively exploited. Independent assessment rates this as a moderate-priority stored XSS rather than a top-tier emergency despite the 8.0 vendor score, since successful abuse requires a non-trivial job-configuration privilege, depends on a second user viewing the crafted report, and caps out at limited confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).