CyberRota Analysis
AI-GeneratedThe Jenkins Coverage Plugin versions up to 3.3358.v9487dde48783 are vulnerable due to inadequate validation of coverage results IDs submitted via the REST API, enabling attackers with Item/Configure permissions to exploit this flaw using a malicious javascript: scheme URL. This results in a stored cross-site scripting (XSS) vulnerability, which could allow attackers to execute arbitrary scripts in the context of users accessing the affected Jenkins instance. Organizations using Jenkins with the Coverage Plugin should prioritize patching this vulnerability to mitigate potential XSS attacks.
Original NVD Description
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.