Arbitrary file write vulnerability in Jenkins Cobertura Plugin

2022-05-2417:10:27

Google

osv.dev

0.001 Low

EPSS

Percentile

27.0%

JSON

An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system. Cobertura Plugin 1.16 sanitizes the file paths to prevent escape from the base directory.

CPENameOperatorVersion
org.jenkins-ci.plugins:coberturaeq1.11
org.jenkins-ci.plugins:coberturaeq1.9.5
org.jenkins-ci.plugins:coberturaeq1.9.7
org.jenkins-ci.plugins:coberturaeq1.5
org.jenkins-ci.plugins:coberturaeq1.9.8
org.jenkins-ci.plugins:coberturaeq1.13
org.jenkins-ci.plugins:coberturaeq1.15
org.jenkins-ci.plugins:coberturaeq1.9.1
org.jenkins-ci.plugins:coberturaeq1.3
org.jenkins-ci.plugins:coberturaeq1.7.1

Name	Operator	Version
org.jenkins-ci.plugins:cobertura	eq	1.11
org.jenkins-ci.plugins:cobertura	eq	1.9.5
org.jenkins-ci.plugins:cobertura	eq	1.9.7
org.jenkins-ci.plugins:cobertura	eq	1.5
org.jenkins-ci.plugins:cobertura	eq	1.9.8
org.jenkins-ci.plugins:cobertura	eq	1.13
org.jenkins-ci.plugins:cobertura	eq	1.15
org.jenkins-ci.plugins:cobertura	eq	1.9.1
org.jenkins-ci.plugins:cobertura	eq	1.3
org.jenkins-ci.plugins:cobertura	eq	1.7.1