Read the docs
TI-2017-14446 Aliases CVE-2017-1000109GHSA-65cq-whr4-7c2v

The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check…

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.

Why it matters now

EPSS 0.00948 61st percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:dependency-check-jenkins-plugin (Maven): 2.0.1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jenkins-ci.plugins:dependency-check-jenkins-plugin (Maven)before 2.0.1.22.0.1.2Patch availableGHSA-65cq-whr4-7c2v
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:dependency-check-jenkins-plugin (Maven) Vendor— Affected before 2.0.1.2 Fixed in 2.0.1.2 Patch available GHSA-65cq-whr4-7c2v

CPE configurations NVD · 51

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.1:*:*:*:*:jenkins:*:*1.0.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.1.1:*:*:*:*:jenkins:*:*1.0.1.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.2:*:*:*:*:jenkins:*:*1.0.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.3:*:*:*:*:jenkins:*:*1.0.3VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.4:*:*:*:*:jenkins:*:*1.0.4VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.4.1:*:*:*:*:jenkins:*:*1.0.4.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.5:*:*:*:*:jenkins:*:*1.0.5VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.7:*:*:*:*:jenkins:*:*1.0.7VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.0.8:*:*:*:*:jenkins:*:*1.0.8VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.0:*:*:*:*:jenkins:*:*1.1.0VulnerableJenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.1:*:*:*:*:jenkins:*:* Versions 1.0.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.1.1:*:*:*:*:jenkins:*:* Versions 1.0.1.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.2:*:*:*:*:jenkins:*:* Versions 1.0.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.3:*:*:*:*:jenkins:*:* Versions 1.0.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.4:*:*:*:*:jenkins:*:* Versions 1.0.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.4.1:*:*:*:*:jenkins:*:* Versions 1.0.4.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.5:*:*:*:*:jenkins:*:* Versions 1.0.5 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.7:*:*:*:*:jenkins:*:* Versions 1.0.7 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.0.8:*:*:*:*:jenkins:*:* Versions 1.0.8 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.0:*:*:*:*:jenkins:*:* Versions 1.1.0 Vulnerable ·Jenkins
Show 41 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.1:*:*:*:*:jenkins:*:*1.1.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.1.1:*:*:*:*:jenkins:*:*1.1.1.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.1.2:*:*:*:*:jenkins:*:*1.1.1.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.2:*:*:*:*:jenkins:*:*1.1.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.3:*:*:*:*:jenkins:*:*1.1.3VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.4:*:*:*:*:jenkins:*:*1.1.4VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.1.4.1:*:*:*:*:jenkins:*:*1.1.4.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.0:*:*:*:*:jenkins:*:*1.2.0VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.1:*:*:*:*:jenkins:*:*1.2.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.2:*:*:*:*:jenkins:*:*1.2.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.3:*:*:*:*:jenkins:*:*1.2.3VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.3.1:*:*:*:*:jenkins:*:*1.2.3.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.3.2:*:*:*:*:jenkins:*:*1.2.3.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.4:*:*:*:*:jenkins:*:*1.2.4VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.5:*:*:*:*:jenkins:*:*1.2.5VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.6:*:*:*:*:jenkins:*:*1.2.6VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.7:*:*:*:*:jenkins:*:*1.2.7VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.7.1:*:*:*:*:jenkins:*:*1.2.7.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.8:*:*:*:*:jenkins:*:*1.2.8VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.9:*:*:*:*:jenkins:*:*1.2.9VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.10:*:*:*:*:jenkins:*:*1.2.10VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.11:*:*:*:*:jenkins:*:*1.2.11VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.2.11.1:*:*:*:*:jenkins:*:*1.2.11.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.0:*:*:*:*:jenkins:*:*1.3.0VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.1:*:*:*:*:jenkins:*:*1.3.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.1.1:*:*:*:*:jenkins:*:*1.3.1.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.1.2:*:*:*:*:jenkins:*:*1.3.1.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.2:*:*:*:*:jenkins:*:*1.3.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.3:*:*:*:*:jenkins:*:*1.3.3VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.4:*:*:*:*:jenkins:*:*1.3.4VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.5:*:*:*:*:jenkins:*:*1.3.5VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.3.6:*:*:*:*:jenkins:*:*1.3.6VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.4.0:*:*:*:*:jenkins:*:*1.4.0VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.4.1:*:*:*:*:jenkins:*:*1.4.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.4.2:*:*:*:*:jenkins:*:*1.4.2VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.4.3:*:*:*:*:jenkins:*:*1.4.3VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.4.4:*:*:*:*:jenkins:*:*1.4.4VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:1.4.5:*:*:*:*:jenkins:*:*1.4.5VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:2.0.0:*:*:*:*:jenkins:*:*2.0.0VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:2.0.1:*:*:*:*:jenkins:*:*2.0.1VulnerableJenkins
cpe:2.3:a:jenkins:owasp_dependency-check:2.0.1.1:*:*:*:*:jenkins:*:*2.0.1.1VulnerableJenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.1:*:*:*:*:jenkins:*:* Versions 1.1.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.1.1:*:*:*:*:jenkins:*:* Versions 1.1.1.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.1.2:*:*:*:*:jenkins:*:* Versions 1.1.1.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.2:*:*:*:*:jenkins:*:* Versions 1.1.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.3:*:*:*:*:jenkins:*:* Versions 1.1.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.4:*:*:*:*:jenkins:*:* Versions 1.1.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.1.4.1:*:*:*:*:jenkins:*:* Versions 1.1.4.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.0:*:*:*:*:jenkins:*:* Versions 1.2.0 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.1:*:*:*:*:jenkins:*:* Versions 1.2.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.2:*:*:*:*:jenkins:*:* Versions 1.2.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.3:*:*:*:*:jenkins:*:* Versions 1.2.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.3.1:*:*:*:*:jenkins:*:* Versions 1.2.3.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.3.2:*:*:*:*:jenkins:*:* Versions 1.2.3.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.4:*:*:*:*:jenkins:*:* Versions 1.2.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.5:*:*:*:*:jenkins:*:* Versions 1.2.5 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.6:*:*:*:*:jenkins:*:* Versions 1.2.6 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.7:*:*:*:*:jenkins:*:* Versions 1.2.7 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.7.1:*:*:*:*:jenkins:*:* Versions 1.2.7.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.8:*:*:*:*:jenkins:*:* Versions 1.2.8 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.9:*:*:*:*:jenkins:*:* Versions 1.2.9 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.10:*:*:*:*:jenkins:*:* Versions 1.2.10 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.11:*:*:*:*:jenkins:*:* Versions 1.2.11 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.2.11.1:*:*:*:*:jenkins:*:* Versions 1.2.11.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.0:*:*:*:*:jenkins:*:* Versions 1.3.0 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.1:*:*:*:*:jenkins:*:* Versions 1.3.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.1.1:*:*:*:*:jenkins:*:* Versions 1.3.1.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.1.2:*:*:*:*:jenkins:*:* Versions 1.3.1.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.2:*:*:*:*:jenkins:*:* Versions 1.3.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.3:*:*:*:*:jenkins:*:* Versions 1.3.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.4:*:*:*:*:jenkins:*:* Versions 1.3.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.5:*:*:*:*:jenkins:*:* Versions 1.3.5 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.3.6:*:*:*:*:jenkins:*:* Versions 1.3.6 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.4.0:*:*:*:*:jenkins:*:* Versions 1.4.0 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.4.1:*:*:*:*:jenkins:*:* Versions 1.4.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.4.2:*:*:*:*:jenkins:*:* Versions 1.4.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.4.3:*:*:*:*:jenkins:*:* Versions 1.4.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.4.4:*:*:*:*:jenkins:*:* Versions 1.4.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:1.4.5:*:*:*:*:jenkins:*:* Versions 1.4.5 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:2.0.0:*:*:*:*:jenkins:*:* Versions 2.0.0 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:2.0.1:*:*:*:*:jenkins:*:* Versions 2.0.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:owasp_dependency-check:2.0.1.1:*:*:*:*:jenkins:*:* Versions 2.0.1.1 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-65cq-whr4-7c2v org.jenkins-ci.plugins:dependency-check-jenkins-plugin (Maven) Fixed in 2.0.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1000109
  2. 2026-10-03 Alias added: GHSA-65cq-whr4-7c2v

References

Advisory 2

Other 1

  • TI-2024-18731 Cross-site scripting in Jenkins OWASP Dependency-Check Plugin CVSS 3.1HIGH 7.3
  • TI-2021-19466 XML external entity injection in Jenkins OWASP Dependency-Check Plugin CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences