PT-2025-50359 · Jenkins · Jenkins Coverage Plugin+1

Kevin Guerroudj · Published 2025-12-03 · Updated 2025-12-14 · CVE-2025-67641

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Coverage Plugin versions 2.3054.ve1ff7b a a 123b and earlier

Description The Jenkins Coverage Plugin does not properly validate the configured coverage results ID when creating coverage results. Specifically, the validation occurs only during UI configuration, not through the REST API. This allows attackers possessing Item/Configure permission to utilize a javascript: scheme URL as an identifier when configuring a job via the REST API, leading to a stored cross-site scripting (XSS) issue. The vulnerable configuration occurs when setting the identifier through the ''/job//api/json' endpoint using the coverageResultsId parameter.

Recommendations Update Jenkins Coverage Plugin to a version later than 2.3054.ve1ff7b a a 123b . As a temporary workaround, restrict access to the REST API endpoint ''/job//api/json'' for users with Item/Configure permission.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00823

CVE-2025-67641

GHSA-V3F3-RF6R-43X5

Affected Products

Jenkins

Jenkins Coverage Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-67641 · Security Note
• https://jenkins.io/security/advisory/2025-12-10/#SECURITY-3611 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00823 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67641 · Vendor Advisory
• https://reddit.com/r/VulnMatter/comments/1pkvele/resumen_diario_de_vulnerabilidades_12122025 · Reddit Post
• https://plugins.jenkins.io/coverage · Note
• https://twitter.com/dailycve/status/1998913854844317798 · Twitter Post
• https://twitter.com/CVEnew/status/2000248622445982125 · Twitter Post
• https://t.me/CVEtracker/39382 · Telegram Post