GHSA-xg77-xqhq-crpr

Suggest an improvement
Source
https://github.com/advisories/GHSA-xg77-xqhq-crpr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xg77-xqhq-crpr/GHSA-xg77-xqhq-crpr.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xg77-xqhq-crpr
Aliases
Published
2022-05-24T17:07:41Z
Modified
2024-01-02T05:49:11.575329Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Stored XSS vulnerability in Code Coverage API Plugin
Details

Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view.

This results in a stored cross-site scripting vulnerability that can be exploited by users able to change the job configuration.

Code Coverage API Plugin 1.1.3 escapes the filename of the coverage report used in its view.

Database specific
{
    "nvd_published_at": "2020-01-29T16:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-19T21:14:50Z"
}
References

Affected packages

Maven / io.jenkins.plugins:code-coverage-api

Package

Name
io.jenkins.plugins:code-coverage-api
View open source insights on deps.dev
Purl
pkg:maven/io.jenkins.plugins/code-coverage-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.3

Affected versions

1.*

1.0.0-alpha-1
1.0.0-rc-1
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.1.0
1.1.1
1.1.2

Database specific

{
    "last_known_affected_version_range": "<= 1.1.2"
}