Jenkins Coverage Plugin
Monthly
Stored cross-site scripting in Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier lets an attacker who already holds Item/Configure permission on a job submit a job configuration through the REST API with a javascript: scheme URL in the unvalidated coverage results ID field, which is then stored and rendered when a victim later opens the job's coverage page. Exploitation therefore requires authenticated low-privilege access (CVSS PR:L) plus victim interaction (UI:R), meaning it is not usable against default unauthenticated Jenkins deployments; Impact on confidentiality, integrity and availability is rated High (CVSS 8.0). No public exploit code or confirmed active exploitation was identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no.
Stored cross-site scripting in Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier lets an attacker who already holds Item/Configure permission on a job submit a job configuration through the REST API with a javascript: scheme URL in the unvalidated coverage results ID field, which is then stored and rendered when a victim later opens the job's coverage page. Exploitation therefore requires authenticated low-privilege access (CVSS PR:L) plus victim interaction (UI:R), meaning it is not usable against default unauthenticated Jenkins deployments; Impact on confidentiality, integrity and availability is rated High (CVSS 8.0). No public exploit code or confirmed active exploitation was identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no.