CVE-2020-2172: XXE vulnerability in Jenkins Code Coverage API Plugin
Summary
CVE-2020-2172: XXE vulnerability in Jenkins Code Coverage API Plugin. Affects io.jenkins.plugins:code-coverage-api versions < 1.1.5. Fixed in 1.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Code Coverage API Plugin is a Maven package (io.jenkins.plugins:code-coverage-api) that provides functionality for generating code coverage reports in Jenkins. It allows users to control the input files for the 'Publish Coverage Report' post-build step. This plugin is vulnerable to XML external entity (XXE) attacks, which can be exploited by a user to extract secrets from the Jenkins controller or perform server-side request forgery.
Vulnerability Detail
The Code Coverage API Plugin version 1.1.4 and earlier does not properly configure its XML parser to prevent XXE attacks. This allows an attacker to craft a file with external entities that can be parsed by Jenkins, leading to the extraction of sensitive information or the manipulation of server-side requests. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 4.99.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The XXE vulnerability in the Jenkins Code Coverage API Plugin (CVE-2020-2172) allows an attacker to extract sensitive information or perform server-side request forgery. It is recommended to upgrade to version 1.1.5 of the plugin to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:code-coverage-api →
FAQ
This vulnerability allows an attacker to extract sensitive information from the Jenkins controller or perform server-side request forgery.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Yes, upgrading to version 1.1.5 of the Code Coverage API Plugin fixes this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cmgm-q8hf-p7jc/GHSA-cmgm-q8hf-p7jc.json).
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:code-coverage-api.
