Skip to content
OpenAdvisories
High · 7.1 CVE-2020-2172 EUVD-2022-3596GHSA-cmgm-q8hf-p7jc

XXE vulnerability in Jenkins Code Coverage API Plugin

Published Apr 7, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Code Coverage API Plugin Package: io.jenkins.plugins:code-coverage-api Category: Web / CMS Ecosystem: Maven

Description

Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Code Coverage API Plugin unspecified – ≤ 1.1.4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.jenkins.plugins:code-coverage-api < 1.1.5 1.1.5 GHSA-cmgm-q8hf-p7jc

References