Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage
    results ID when creating coverage results, only when submitting the job configuration through the UI,
    allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by
    configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
    (CVE-2025-67641)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage     results ID when creating coverage results, only when submitting the job configuration through the UI,     allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by     configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
    (CVE-2025-67641)

  - Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace     directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers     able to control the workspace directory name to inject arbitrary OS commands. (CVE-2025-67640)

  - A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with     View/Read permission to view encrypted password values in views. (CVE-2025-67636)

  - Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for     Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially     capture Vault credentials they are not entitled to. (CVE-2025-67642)

  - A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to     see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this     fix, anyone could see this list as a dropdown on the Jenkins UI. (CVE-2025-13472)

  - Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly     perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers     with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
    (CVE-2025-67643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
436345	SCA: security update for io.jenkins.plugins:coverage (GHSA-v3f3-rf6r-43x5)	Tenable Cloud Security	SCA Checks	medium
436345	SCA: security update for io.jenkins.plugins:coverage (GHSA-v3f3-rf6r-43x5)	Tenable Self-Hosted Container Security	SCA Checks	medium
278130	Jenkins plugins Multiple Vulnerabilities (2025-12-10)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-67641

medium

Tenable Plugins

medium

medium

medium