GitHub Advisoryadvisory · Maven

GHSA-m935-chfp-9f63 Arbitrary file write vulnerability in Jenkins Cobertura Plugin

MEDIUM Published 2022-05-24 Modified 2023-01-05 Official page ↗
Aliases
CVE-2020-2139
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:cobertura
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2023-01-05

Affected packages

• Maven org.jenkins-ci.plugins:cobertura: < 1.16 → fixed in 1.16

Description

An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system. Cobertura Plugin 1.16 sanitizes the file paths to prevent escape from the base directory.

Related

Alias · CVE (1)

  • CVE-2020-2139 An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References