CVE-2020-2139

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Cobertura Plugin	>= unspecified, <= 1.15

References

http://www.openwall.com/lists/oss-security/2020/03/09/1Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1668Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/03/09/1Third Party Advisory
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1668Vendor Advisory

Timeline

Published: Mar 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-213948.8SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDataback CVE-2020-21406.1Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a refl CVE-2020-214007.2SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modi CVE-2020-214057.5An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk CVE-2020-214067.5An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisp CVE-2020-21414.3A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Pe CVE-2020-21424.3A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.CVE-2020-214267.8Buffer Overflow vulnerability in function C_IStream::read in PluginEXR.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code CVE-2020-214277.8Buffer Overflow vulnerability in function LoadPixelDataRLE8 in PluginBMP.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary co CVE-2020-214287.8Buffer Overflow vulnerability in function LoadRGB in PluginDDS.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cau CVE-2020-21435.3Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, p CVE-2020-214316.5HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.