Description
Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Code Coverage API Plugin | unspecified – ≤ 1.4.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.jenkins.plugins:code-coverage-api | < 1.4.1 | 1.4.1 | GHSA-58pr-hprx-7hg6 |