Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-28153 · ADVISORY
• jenkinsci/dependency-check-plugin commit b3b286a · WEB
• jenkinsci/dependency-check-plugin · PACKAGE
• jenkins.io/security/advisory/2024-03-06 · WEB
• openwall.com/lists/oss-security/2024/03/06/3 · WEB

org.jenkins-ci.plugins:dependency-check-jenkins-plugin のその他の脆弱性

• CVE-2021-43577高 7.1Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
• CVE-2017-1000109中 6.1The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scrip…