GHSA-xg77-xqhq-crpr

GitHub Security Advisory

Stored XSS vulnerability in Code Coverage API Plugin

✓ GitHub Reviewed MODERATE Has CVE

Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view.

This results in a stored cross-site scripting vulnerability that can be exploited by users able to change the job configuration.

Code Coverage API Plugin 1.1.3 escapes the filename of the coverage report used in its view.

Maven io.jenkins.plugins:code-coverage-api

Affected versions: 0 (fixed in 1.1.3)

CVE-2020-2106

GHSA ID

GHSA-xg77-xqhq-crpr

Published

May 24, 2022 5:07 PM

Last Modified

December 19, 2022 9:14 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

io.jenkins.plugins:code-coverage-api

GitHub Reviewed

✓ Yes

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.