Not rated

CVE-2021-21677 Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java…

Description

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Code Coverage API Plugin 1.4	earliest → 1.4.0	No fix stated

The 3 CVEs of Jenkins Code Coverage API Plugin →

CVE-2020-2172 Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity… Not rated CVE-2020-2106 Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view,… Not rated

Do you use Jenkins Code Coverage API Plugin?

Track this CVE Watch Jenkins Code Coverage API Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2021-21677

Timeline

Published August 31, 2021
Last modified August 3, 2024

References

www.jenkins.io www.jenkins.io
[oss-security] 20210831 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Track this CVE

CVE-2021-21677 Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java…

Description

Affected products and versions

Other CVEs of Jenkins Code Coverage API Plugin