Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14Zzc3LXhxaHEtY3Jwcs4AAjcK

Stored XSS vulnerability in Code Coverage API Plugin

Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view.

This results in a stored cross-site scripting vulnerability that can be exploited by users able to change the job configuration.

Code Coverage API Plugin 1.1.3 escapes the filename of the coverage report used in its view.

Permalink: https://github.com/advisories/GHSA-xg77-xqhq-crpr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14Zzc3LXhxaHEtY3Jwcs4AAjcK
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 5 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-xg77-xqhq-crpr, CVE-2020-2106
References:

Affected Version Ranges: <= 1.1.2
Fixed in: 1.1.3