Vulnerabilidades do Jenkins Project Jenkins Coverage Plugin
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Jenkins Project Jenkins Coverage Plugin: 2 registro(s), com versões afetadas e correções.
CVE-2026-92135
Alta · 8.0
CWE-79 16/09/2026
Cross-site Scripting (XSS) em Jenkins Project Jenkins Coverage Plugin
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2025-67641
Média · 5.4
CWE-79 10/12/2025
Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability
Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.