CVE-2024-28153

Опубликовано: 06 мар. 2024

Источник: nvd

CVSS3: 5.4

CVSS3: 7.3

EPSS Низкий

Описание

Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability.

Ссылки

http://www.openwall.com/lists/oss-security/2024/03/06/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3344
Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/03/06/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3344
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:owasp_dependency-check:*:*:*:*:*:jenkins:*:*

Версия до 5.4.6 (исключая)

EPSS

Процентиль: 78%

0.01117

Низкий

5.4 Medium

CVSS3

7.3 High

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-9pp4-mx6x-xh36

CVSS3: 5.4

github

почти 2 года назад

Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability

EPSS

Процентиль: 78%

0.01117

Низкий

5.4 Medium

CVSS3

7.3 High

CVSS3

Дефекты

CWE-79