CVE-2020-2106: XSS
First published: Wed Jan 29 2020(Updated: )
Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view. This results in a stored cross-site scripting vulnerability that can be exploited by users able to change the job configuration. Code Coverage API Plugin 1.1.3 escapes the filename of the coverage report used in its view.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/io.jenkins.plugins:code-coverage-api | <=1.1.2 | 1.1.3 |
| Jenkins Code Coverage Api | <=1.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2020/01/29/1
- https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1680
- https://nvd.nist.gov/vuln/detail/CVE-2020-2106
- https://github.com/jenkinsci/code-coverage-api-plugin/commit/24921da6d625c4deb259049446dc2b45b1da4603
- https://github.com/advisories/GHSA-xg77-xqhq-crpr (Advisory)
Frequently Asked Questions
What is the severity of CVE-2020-2106?
CVE-2020-2106 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting.
How do I fix CVE-2020-2106?
To fix CVE-2020-2106, upgrade the Code Coverage API Plugin to version 1.1.3 or later.
What does CVE-2020-2106 affect?
CVE-2020-2106 affects versions of the Code Coverage API Plugin prior to 1.1.3.
What type of vulnerability is CVE-2020-2106?
CVE-2020-2106 is a stored cross-site scripting (XSS) vulnerability.
Who is at risk from CVE-2020-2106?
Users with the ability to change job configurations in Jenkins are at risk from CVE-2020-2106.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-xg77-xqhq-crpr
- alias/CVE-2020-2106
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- canonical/jenkins code coverage api
- version/jenkins code coverage api/1.1.2
- package-manager/maven