io.jenkins.plugins/code-coverage-api vulnerabilities

Latest io.jenkins.plugins/code-coverage-api CVEs

Newest publication first

1. CVE-2021-21677 RCE vulnerability in Jenkins Code Coverage API Plugin

   Published 2021-08-31

   High·CVSS 8.8 EPSS 2.2%

   Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.

2. CVE-2020-2172 XXE vulnerability in Jenkins Code Coverage API Plugin

   Published 2020-04-07

   Medium·CVSS 6.5 EPSS 1.1%

   Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

3. CVE-2020-2106 Stored XSS vulnerability in Code Coverage API Plugin

   Published 2020-01-29

   Medium·CVSS 5.4 EPSS 0.74%

   Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.