Vulnerabilites related to Jenkins Project - Jenkins OWASP Dependency-Check Plugin
cve-2024-28153
Vulnerability from cvelistv5
Published
2024-03-06 17:01
Modified
2025-03-25 16:14
Severity ?
EPSS score ?
Summary
Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Jenkins Project | Jenkins OWASP Dependency-Check Plugin |
Version: 0 |
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.3, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-28153", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-03-14T19:43:22.490968Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-03-25T16:14:29.682Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T00:48:49.418Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "Jenkins Security Advisory 2024-03-06", tags: [ "vendor-advisory", "x_transferred", ], url: "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3344", }, { tags: [ "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2024/03/06/3", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "Jenkins OWASP Dependency-Check Plugin", vendor: "Jenkins Project", versions: [ { lessThanOrEqual: "5.4.5", status: "affected", version: "0", versionType: "maven", }, ], }, ], descriptions: [ { lang: "en", value: "Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability.", }, ], providerMetadata: { dateUpdated: "2024-05-01T18:06:28.375Z", orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", shortName: "jenkins", }, references: [ { name: "Jenkins Security Advisory 2024-03-06", tags: [ "vendor-advisory", ], url: "https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3344", }, { url: "http://www.openwall.com/lists/oss-security/2024/03/06/3", }, ], }, }, cveMetadata: { assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", assignerShortName: "jenkins", cveId: "CVE-2024-28153", datePublished: "2024-03-06T17:01:56.824Z", dateReserved: "2024-03-05T19:29:05.205Z", dateUpdated: "2025-03-25T16:14:29.682Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2021-43577
Vulnerability from cvelistv5
Published
2021-11-12 10:35
Modified
2024-08-04 04:03
Severity ?
EPSS score ?
Summary
Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2021/11/12/1 | mailing-list, x_refsource_MLIST |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Jenkins project | Jenkins OWASP Dependency-Check Plugin |
Version: unspecified < |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T04:03:08.419Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488", }, { name: "[oss-security] 20211112 Multiple vulnerabilities in Jenkins plugins", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2021/11/12/1", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Jenkins OWASP Dependency-Check Plugin", vendor: "Jenkins project", versions: [ { lessThanOrEqual: "5.1.1", status: "affected", version: "unspecified", versionType: "custom", }, { lessThan: "unspecified", status: "unknown", version: "next of 5.1.1", versionType: "custom", }, ], }, ], descriptions: [ { lang: "en", value: "Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.", }, ], providerMetadata: { dateUpdated: "2023-10-24T15:52:17.317Z", orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", shortName: "jenkins", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488", }, { name: "[oss-security] 20211112 Multiple vulnerabilities in Jenkins plugins", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://www.openwall.com/lists/oss-security/2021/11/12/1", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "jenkinsci-cert@googlegroups.com", ID: "CVE-2021-43577", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Jenkins OWASP Dependency-Check Plugin", version: { version_data: [ { version_affected: "<=", version_value: "5.1.1", }, { version_affected: "?>", version_value: "5.1.1", }, ], }, }, ], }, vendor_name: "Jenkins project", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-611: Improper Restriction of XML External Entity Reference", }, ], }, ], }, references: { reference_data: [ { name: "https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488", refsource: "CONFIRM", url: "https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2488", }, { name: "[oss-security] 20211112 Multiple vulnerabilities in Jenkins plugins", refsource: "MLIST", url: "http://www.openwall.com/lists/oss-security/2021/11/12/1", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", assignerShortName: "jenkins", cveId: "CVE-2021-43577", datePublished: "2021-11-12T10:35:21", dateReserved: "2021-11-11T00:00:00", dateUpdated: "2024-08-04T04:03:08.419Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }