GHSA-v3f3-rf6r-43x5

Source

https://github.com/advisories/GHSA-v3f3-rf6r-43x5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-v3f3-rf6r-43x5/GHSA-v3f3-rf6r-43x5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v3f3-rf6r-43x5

Aliases

CVE-2025-67641

Published

2025-12-10T18:30:27Z

Modified

2025-12-10T20:41:14Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

Details

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-10T20:16:07Z",
    "nvd_published_at": "2025-12-10T17:15:56Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / io.jenkins.plugins:coverage

Package

Name: io.jenkins.plugins:coverage; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/coverage

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.3056

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.8.0

1.9.0

1.10.0

1.11.0

1.11.1

1.12.0

1.13.0

1.14.0

1.15.0

1.16.0

1.16.1

2.*

2.1.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.7.1

2.8.0

2.2873.v430507dfc44b_

2.2875.ve560756ff429

2.2879.v7434570a_8b_94

2.2901.v47e734811a_92

2.2912.v3dea_6a_4a_73f7

2.2933.v84e9b_19d9e6f

2.2941.v08df75b_767f1

2.2962.v6a_3557c95fd0

2.2977.v0e1c1d11042d

2.3026.ve83b_5d9dfb_c4

2.3036.v90d485b_810c6

2.3054.ve1ff7b_a_a_123b_

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-v3f3-rf6r-43x5/GHSA-v3f3-rf6r-43x5.json"