com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.0.0, <=1.7.1) +2 more potentially affected by CVE-2020-2139 via org.jenkins-ci.plugins:cobertura (>=1.9.3, <=1.9.7)

org.jenkins-ci.plugins:cobertura MAVEN version =1.9.3, =1.7.2, =1.0.0, =1.8, =1.0, =1.7.2 Source cves: CVE-2020-2139 Source advisory: OSV:GHSA-M935-CHFP-9F63...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.0.0, <=1.7.1) +2 more potentially affected by CVE-2020-2139 via org.jenkins-ci.plugins:cobertura (>=1.9.3, <=1.9.7)

org.jenkins-ci.plugins:cobertura MAVEN version =1.9.3, =1.7.2, =1.0.0, =1.8, =1.0, =1.7.2 Source cves: CVE-2020-2139 Source advisory: GHSA-M935-CHFP-9F63...

CVE-2020-2139

The CVE concerns Jenkins Cobertura Plugin versions 1.15 and earlier, where an arbitrary file write vulnerability lets attackers who can control the coverage report file contents overwrite arbitrary files on the Jenkins master filesystem. The root cause is the plugin’s path handling not preventing...