io.jenkins.plugins:code-coverage-api

Maven3 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting io.jenkins.plugins:code-coverage-apipage 1 of 1

CVE-2020-2106MEDIUMCVSS 5.4EG 5.4fixed in 1.1.3
2020-01-29
vulnerable: 1.0.0 ... 1.1.2 (19 versions)
Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.
CVE-2020-2172MEDIUMCVSS 6.5EG 6.5fixed in 1.1.5
2020-04-07
vulnerable: 1.0.0 ... 1.1.4 (21 versions)
Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-21677HIGHCVSS 8.8EG 8.8fixed in 1.4.1
2021-08-31
vulnerable: 1.0.0 ... 1.4.0 (28 versions)
Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.

Check whether io.jenkins.plugins:code-coverage-api is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for io.jenkins.plugins:code-coverage-api CVEs against the assets you own.

Book a Demo →