ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 3
ΠΠΎΠ»ΠΈΡΠ΅ΡΡΠ²ΠΎ 3
CVE-2025-67641
Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
GHSA-v3f3-rf6r-43x5
Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability
BDU:2026-00823
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΏΠ»Π°Π³ΠΈΠ½Π° Coverage ΡΠ΅ΡΠ²Π΅ΡΠ° Π°Π²ΡΠΎΠΌΠ°ΡΠΈΠ·Π°ΡΠΈΠΈ Jenkins, ΡΠ²ΡΠ·Π°Π½Π½Π°Ρ Ρ Π½Π΅ΠΏΡΠΈΠ½ΡΡΠΈΠ΅ΠΌ ΠΌΠ΅Ρ ΠΏΠΎ Π·Π°ΡΠΈΡΠ΅ ΡΡΡΡΠΊΡΡΡΡ Π²Π΅Π±-ΡΡΡΠ°Π½ΠΈΡΡ, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ ΠΏΡΠΎΠ²ΠΎΠ΄ΠΈΡΡ ΠΌΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΡΠ΅ ΡΡΠ΅Π½Π°ΡΠ½ΡΠ΅ Π°ΡΠ°ΠΊΠΈ
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ | CVSS | EPSS | ΠΠΏΡΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ | |
|---|---|---|---|---|
 | CVE-2025-67641 Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability. | CVSS3: 5.4 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 8 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
| GHSA-v3f3-rf6r-43x5 Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability | CVSS3: 8 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 8 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
 | BDU:2026-00823 Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΠΏΠ»Π°Π³ΠΈΠ½Π° Coverage ΡΠ΅ΡΠ²Π΅ΡΠ° Π°Π²ΡΠΎΠΌΠ°ΡΠΈΠ·Π°ΡΠΈΠΈ Jenkins, ΡΠ²ΡΠ·Π°Π½Π½Π°Ρ Ρ Π½Π΅ΠΏΡΠΈΠ½ΡΡΠΈΠ΅ΠΌ ΠΌΠ΅Ρ ΠΏΠΎ Π·Π°ΡΠΈΡΠ΅ ΡΡΡΡΠΊΡΡΡΡ Π²Π΅Π±-ΡΡΡΠ°Π½ΠΈΡΡ, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ ΠΏΡΠΎΠ²ΠΎΠ΄ΠΈΡΡ ΠΌΠ΅ΠΆΡΠ°ΠΉΡΠΎΠ²ΡΠ΅ ΡΡΠ΅Π½Π°ΡΠ½ΡΠ΅ Π°ΡΠ°ΠΊΠΈ | CVSS3: 8 | 0% ΠΠΈΠ·ΠΊΠΈΠΉ | 9 ΠΌΠ΅ΡΡΡΠ΅Π² Π½Π°Π·Π°Π΄ |
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π½Π° ΡΡΡΠ°Π½ΠΈΡΡ