Medium · 6.5 CVE-2020-2139 EUVD-2022-4530GHSA-m935-chfp-9f63

Arbitrary file write vulnerability in Jenkins Cobertura Plugin

Published Mar 9, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Cobertura Plugin Package: org.jenkins-ci.plugins:cobertura Category: Web / CMS Ecosystem: Maven

Description

An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Cobertura Plugin	unspecified – ≤ 1.15	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:cobertura	< 1.16	1.16	GHSA-m935-chfp-9f63

References

https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1668
[oss-security] 20200309 Multiple vulnerabilities in Jenkins plugins mailing-list