Jenkins Dependency Graph Viewer vulnerabilities

2 CVEs affecting Jenkins Dependency Graph Viewer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-10349, published 2019-07-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10349, published 2019-07-11. Medium severity, CVSS 5.4. EPSS: 3.9% chance of exploitation in the next 30 days. A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in…
CVE-2017-1000388, published 2018-01-26. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to…