Coverage
Monthly
Stored cross-site scripting in the Jenkins Coverage Plugin (2.3054.ve1ff7b_a_a_123b_ and earlier) lets an authenticated user with Item/Configure permission set a javascript:-scheme URL as the coverage results ID by submitting the job configuration through the REST API, a path that bypasses the UI validation that would otherwise reject it. The injected script then executes in the browser of any user who opens the affected job's coverage results page (CVSS 5.4, CWE-79), giving script execution limited to the victim's session (low confidentiality and integrity impact). No public exploit code has been identified at time of analysis and EPSS is low at 0.31% (22nd percentile); the practical risk is concentrated in multi-tenant or lower-trust Jenkins deployments where non-administrators are permitted to configure jobs.
Stored cross-site scripting in the Jenkins Coverage Plugin (2.3054.ve1ff7b_a_a_123b_ and earlier) lets an authenticated user with Item/Configure permission set a javascript:-scheme URL as the coverage results ID by submitting the job configuration through the REST API, a path that bypasses the UI validation that would otherwise reject it. The injected script then executes in the browser of any user who opens the affected job's coverage results page (CVSS 5.4, CWE-79), giving script execution limited to the victim's session (low confidentiality and integrity impact). No public exploit code has been identified at time of analysis and EPSS is low at 0.31% (22nd percentile); the practical risk is concentrated in multi-tenant or lower-trust Jenkins deployments where non-administrators are permitted to configure jobs.