CVE-2020-2138: XXE vulnerability in Jenkins Cobertura Plugin
Summary
CVE-2020-2138: XXE vulnerability in Jenkins Cobertura Plugin. Affects org.jenkins-ci.plugins:cobertura versions < 1.16. Fixed in 1.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Cobertura Plugin is a tool used for code coverage analysis in Jenkins, an open-source automation server. It integrates with the Cobertura library to generate reports on code coverage metrics. The plugin allows users to configure post-build steps to publish Cobertura coverage reports. However, versions 1.15 and earlier of the plugin do not properly configure the XML parser, making them vulnerable to XML external entity (XXE) attacks.
Vulnerability Detail
The XXE vulnerability in the Jenkins Cobertura Plugin (CVE-2020-2138) arises from the plugin's failure to prevent XML external entity attacks. An attacker who can control the input files for the 'Publish Cobertura Coverage Report' post-build step can exploit this vulnerability. By crafting a malicious file with external entities, the attacker can extract sensitive information from the Jenkins controller or perform server-side request forgery. The vulnerability has a CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Cobertura Plugin version 1.16 addresses this issue by disabling external entity resolution for its XML parser.
How To Fix
Latest published version: 1.17 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the Cobertura Plugin to ensure the security of the Jenkins environment.
Conclusion
The XXE vulnerability in the Jenkins Cobertura Plugin (CVE-2020-2138) exposes Jenkins environments to potential unauthorized access and server-side request forgery. It is crucial to update the Cobertura Plugin to version 1.16 or later to mitigate this vulnerability. For more information and assistance, please reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cobertura →
FAQ
The vulnerability allows an attacker to extract sensitive information from the Jenkins controller or perform server-side request forgery, potentially leading to unauthorized access or further attacks.
Versions 1.15 and earlier of the Cobertura Plugin are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There are no known public exploits for this vulnerability at the time of this advisory.
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cobertura.
