CVE-2020-2106: Stored XSS vulnerability in Code Coverage API Plugin
Summary
CVE-2020-2106: Stored XSS vulnerability in Code Coverage API Plugin. Affects io.jenkins.plugins:code-coverage-api versions < 1.1.3. Fixed in 1.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Code Coverage API Plugin is a Maven package that provides functionality for generating code coverage reports in Jenkins. It allows users to view and analyze the coverage reports for their projects. The plugin is integrated into the Jenkins job configuration and can be customized to generate coverage reports for different programming languages and frameworks.
Vulnerability Detail
The Code Coverage API Plugin version 1.1.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin does not properly escape the filename of the coverage report used in its view, allowing an attacker with the ability to change the job configuration to inject malicious scripts. This vulnerability can be exploited by an authenticated user to execute arbitrary JavaScript code in the context of other users who view the coverage report. The impact of this vulnerability can range from stealing sensitive information to performing actions on behalf of the affected users.
How To Fix
Latest published version: 4.99.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.1.3 is not immediately possible, a temporary workaround is to disable the Code Coverage API Plugin or restrict access to the job configuration to trusted users only. Disabling the plugin will prevent the rendering of coverage reports and eliminate the risk of XSS attacks. Restricting access to the job configuration will limit the number of users who can potentially exploit this vulnerability.
Conclusion
The Code Coverage API Plugin version 1.1.2 and earlier is vulnerable to a stored XSS attack. Upgrading to version 1.1.3 or later is recommended to fix this vulnerability. In the meantime, disabling the plugin or restricting access to the job configuration can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:code-coverage-api →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other users who view the coverage report. This can lead to the theft of sensitive information or unauthorized actions performed on behalf of the affected users.
Any authenticated user with the ability to change the job configuration can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:code-coverage-api.
