Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report
    used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job
    configurations. (CVE-2020-2106)

The version of Jenkins running on the remote web server is prior to 2.219 or is a version of Jenkins LTS prior to 2.204.2. It is, therefore, affected by multiple vulnerabilities:

  - An UDP amplification reflection attack can be used in a DDoS attack     on a Jenkins master. Within the same network, spoofed UDP packets     could also be sent to make two Jenkins masters go into an infinite     loop of replies to one another, thus causing a denial of service.
    (CVE-2020-2100)

  - A non-constant time comparison of inbound TCP agent connection secret     is used when an inbound TCP agent connection is initiated. This allows     attackers to use statistical methods to obtain the connection secret.
    (CVE-2020-2101)

  - A non-constant time HMAC comparison is used when checking whether two     HMACs are equal. This could potentially allow attackers to use     statistical methods to obtain a valid HMAC for an attacker-controlled     input value. (CVE-2020-2102)

  - User metadata on the /whoAmI page includes the HTTP session ID which     allows attackers able to exploit a cross-site scripting vulnerability     to obtain the HTTP session ID value. (CVE-2020-2103)

  - A lack of appropriate permissions allows anyone with Overall/Read     permissions to access the JVM memory usage chart for the Jenkins master.
    (CVE-2020-2104)

  - The Jenkins REST APIs allows an attacker to perform a clickjacking     attack by routing them to a specially crafted web page, and can expose     the content of the REST API endpoint. (CVE-2020-2105)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jenkins Security Advisory : Description(High) SECURITY-1682 / CVE-2020-2099 Inbound TCP Agent Protocol/3 authentication bypass (Medium) SECURITY-1641 / CVE-2020-2100 Jenkins vulnerable to UDP amplification reflection attack (Medium) SECURITY-1659 / CVE-2020-2101 Non-constant time comparison of inbound TCP agent connection secret (Medium) SECURITY-1660 / CVE-2020-2102 Non-constant time HMAC comparison (Medium) SECURITY-1695 / CVE-2020-2103 Diagnostic page exposed session cookies (Medium) SECURITY-1650 / CVE-2020-2104 Memory usage graphs accessible to anyone with Overall/Read (Low) SECURITY-1704 / CVE-2020-2105 Jenkins REST APIs vulnerable to clickjacking (Medium) SECURITY-1680 / CVE-2020-2106 Stored XSS vulnerability in Code Coverage API Plugin (Medium) SECURITY-1565 / CVE-2020-2107 Fortify Plugin stored credentials in plain text (High) SECURITY-1719 / CVE-2020-2108 XXE vulnerability in WebSphere Deployer Plugin

ID	Name	Product	Family	Type	Severity
420481	SCA: security update for io.jenkins.plugins:code-coverage-api (GHSA-xg77-xqhq-crpr)	Tenable Cloud Security	SCA Checks	Local	medium
420481	SCA: security update for io.jenkins.plugins:code-coverage-api (GHSA-xg77-xqhq-crpr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
133527	Jenkins < 2.204.2 LTS / 2.219 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	medium
133329	FreeBSD : jenkins -- multiple vulnerabilities (a250539d-d1d4-4591-afd3-c8bdfac335d8)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2020-2106

medium

Tenable Plugins

medium

medium

medium

high