GitHub Advisoryadvisory · Maven

GHSA-xg77-xqhq-crpr Stored XSS vulnerability in Code Coverage API Plugin

MEDIUM Published 2022-05-24 Modified 2022-12-19 Official page ↗
Aliases
CVE-2020-2106
Ecosystem
Maven
Packages
io.jenkins.plugins:code-coverage-api
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-19

Affected packages

• Maven io.jenkins.plugins:code-coverage-api: < 1.1.3 → fixed in 1.1.3

Description

Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view. This results in a stored cross-site scripting vulnerability that can be exploited by users able to change the job configuration. Code Coverage API Plugin 1.1.3 escapes the filename of the coverage report used in its view.

Related

Alias · CVE (1)

  • CVE-2020-2106 Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References