{"id":"CVE-2025-67641","aliases":["EUVD-2025-202455","GHSA-v3f3-rf6r-43x5"],"status":"published","title":"Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability","description":"Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00307,"percentile":0.23723,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-12-10T16:50:39Z","modified":"2026-10-14T21:10:00Z","fixes":[{"ecosystem":"Maven","package":"io.jenkins.plugins:coverage","fixed_in":["2.3056"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.jenkins.plugins:coverage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3056"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.jenkins.plugins:coverage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3056"}]}],"versions":["1.0.0","1.1.0","1.10.0","1.11.0","1.11.1","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.16.1","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0","2.1.0","2.2.0","2.2873.v430507dfc44b_","2.2875.ve560756ff429","2.2879.v7434570a_8b_94","2.2901.v47e734811a_92","2.2912.v3dea_6a_4a_73f7","2.2933.v84e9b_19d9e6f","2.2941.v08df75b_767f1","2.2962.v6a_3557c95fd0","2.2977.v0e1c1d11042d","2.3.0","2.3026.ve83b_5d9dfb_c4","2.3036.v90d485b_810c6","2.3054.ve1ff7b_a_a_123b_","2.4.0","2.5.0","2.6.0","2.7.0","2.7.1","2.8.0"]}],"products":[{"vendor":"jenkins","product":"coverage"},{"vendor":"jenkins project","product":"jenkins coverage plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3611","tags":["vendor-advisory","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67641","tags":["advisory"]},{"url":"https://github.com/jenkinsci/coverage-plugin/commit/1dfe888b02499d39185397862cf2790efc03e955","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v3f3-rf6r-43x5"},{"url":"https://github.com/jenkinsci/coverage-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-67641","description":"Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.","status":"published","published":"2025-12-10T16:50:39.402Z","modified":"2025-12-10T18:16:02.206Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2025-202455","description":"Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.","status":"published","published":"2025-12-10T16:50:39Z","modified":"2025-12-10T18:16:02Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:07.060478Z"}],"ghsa":[{"id":"GHSA-v3f3-rf6r-43x5","title":"Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability","description":"Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.","status":"published","published":"2025-12-10T18:30:27Z","modified":"2025-12-10T20:16:08Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-67641","description":"Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.","status":"published","published":"2025-12-10T17:15:56.63Z","modified":"2026-10-14T21:10:00.183Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:49.468427Z"}],"osv":[{"id":"GHSA-v3f3-rf6r-43x5","title":"Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability","description":"Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.","status":"published","published":"2025-12-10T18:30:27Z","modified":"2025-12-10T20:41:14.62843Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.639206Z"}]}}