CVE-2024-28153: Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability

March 6, 2024 (updated January 21, 2025)

Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability.

References

github.com/advisories/GHSA-9pp4-mx6x-xh36
github.com/jenkinsci/dependency-check-plugin
github.com/jenkinsci/dependency-check-plugin/commit/b3b286a9615603f0294eb740193d153d843fae3a
nvd.nist.gov/vuln/detail/CVE-2024-28153
www.jenkins.io/security/advisory/2024-03-06/

Code Behaviors & Features

Detect and mitigate CVE-2024-28153 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →