Jenkins Coverage Plugin Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Jenkins Coverage Plugin, specifically in versions through 2.3054.ve1ff7b_a_a_123b_. The vulnerability arises because the plugin does not properly validate coverage results IDs when creating coverage results, allowing attackers with Item/Configure permission to inject a 'javascript:' scheme URL as an identifier. This issue can be exploited by configuring the job through the REST API, bypassing the validation that occurs when submitting job configurations via the user interface.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users of the Jenkins Coverage Plugin should update to version 2.3056.v1dfe888b_0249, which includes the necessary validation for coverage results IDs. Instructions for updating can be found on the Jenkins Update Center.