CVE-2020-2106

—

CVSS 3.1

5.4 medium

EPSS

<1%p52

Published

Jan 29, 2020 (Jan 29, 2020)

Modified

Jun 17, 2026

Description

Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.

Vendors: jenkins
Products: code coverage api
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.