6.5med
CVE-2020-2139
Arbitrary file write vulnerability in Jenkins Cobertura Plugin
Also known as GHSA-m935-chfp-9f63
Published 6 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.
Exploit prediction (EPSS)
1.59% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 8.5 | AV:N/AC:L/Au:S/C:N/I:C/A:C |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:cobertura | <1.16 | 1.16 |
Affected products
- Jenkins project Jenkins Cobertura Plugin
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- jenkins.io /security/advisory/2020-03-09/#SECURITY-1668 · x_refsource_CONFIRM, x_transferred
- openwall.com /lists/oss-security/2020/03/09/1 · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2020-2139 · advisory
- github.com /jenkinsci/cobertura-plugin/commit/ea41b3f86a24ab398a588bde6a4eada869bed391 · web
- github.com /jenkinsci/cobertura-plugin · package
Sources
- CVE List: CVE-2020-2139
- GitHub Advisory: GHSA-m935-chfp-9f63
- NVD: CVE-2020-2139
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.