GitHub Advisoryadvisory · Maven

GHSA-v3f3-rf6r-43x5 Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

HIGH Published 2025-12-10 Modified 2025-12-10 Official page ↗
Aliases
CVE-2025-67641
Ecosystem
Maven
Packages
io.jenkins.plugins:coverage
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2025-12-10

Affected packages

• Maven io.jenkins.plugins:coverage: < 2.3056 → fixed in 2.3056

Description

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-67641 Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References