CVE-2020-2106 - Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations

Back Back to CVE browser

MEDIUM

Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations

Published Jan 29, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 0.73%

Description

Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.

Affected products

Vendor Jenkins project Product Jenkins Code Coverage API Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.1.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Code Coverage API Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

http://www.openwall.com/lists/oss-security/2020/01/29/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5780
Advisory
https://github.com/advisories/GHSA-xg77-xqhq-crpr
Advisory
https://github.com/jenkinsci/code-coverage-api-plugin/commit/24921da6d625c4deb259049446dc2b45b1da4603
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1680
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2106

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/01/29/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5780		Advisory
https://github.com/advisories/GHSA-xg77-xqhq-crpr		Advisory
https://github.com/jenkinsci/code-coverage-api-plugin/commit/24921da6d625c4deb259049446dc2b45b1da4603
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1680		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2106