Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2020-2106: Jenkins Code Coverage API Plugin lets attackers inject scripts
CVE-2020-2106 · published 6 years ago
Summary
The Code Coverage API plugin for Jenkins (versions 1.1.2 and earlier) fails to clean the file name of a coverage report before displaying it. If someone who can modify a job’s settings supplies a malicious file name, they could cause hidden code to run in anyone’s browser who views the report. Update the plugin to the latest version or remove it if not needed to eliminate the risk.
What to do
- Update jenkins io.jenkins.plugins:code-coverage-api to version 1.1.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jenkins | io.jenkins.plugins:code-coverage-api |
<= 1.1.2 Fix: upgrade to 1.1.3
|
| – | jenkins | code_coverage_api |
<= 1.1.2 cpe:2.3:a:jenkins:code_coverage_api:*:*:*:*:*:jenkins:*:* |
Original advisory text
Stored XSS vulnerability in Code Coverage API Plugin
Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-2106
- https://github.com/jenkinsci/code-coverage-api-plugin/commit/24921da6d625c4deb25...
- https://github.com/advisories/GHSA-xg77-xqhq-crpr
- http://www.openwall.com/lists/oss-security/2020/01/29/1 Mailing List Third Party Advisory
- https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1680 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published29 Jan 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta