CVE-2020-2139: Arbitrary file write vulnerability in Jenkins Cobertura Plugin
Summary
CVE-2020-2139: Arbitrary file write vulnerability in Jenkins Cobertura Plugin. Affects org.jenkins-ci.plugins:cobertura versions < 1.16. Fixed in 1.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Cobertura Plugin is a tool used for code coverage analysis in Jenkins, an open-source automation server. It integrates with Cobertura, a popular code coverage tool, to generate coverage reports for Java projects. The plugin allows users to view and analyze code coverage metrics, helping them identify areas of the codebase that need improvement. However, versions 1.15 and earlier of the Cobertura Plugin are vulnerable to an arbitrary file write vulnerability.
Vulnerability Detail
The arbitrary file write vulnerability in Jenkins Cobertura Plugin allows attackers who can control the coverage report file contents to overwrite any file on the Jenkins master file system. This means that an attacker with the ability to manipulate the coverage report can potentially modify critical files on the Jenkins server, leading to unauthorized access, data loss, or other malicious activities. The vulnerability was addressed in Cobertura Plugin version 1.16, which sanitizes the file paths to prevent escaping from the base directory.
How To Fix
Latest published version: 1.17 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by restricting access to the coverage report files and implementing proper file system permissions on the Jenkins master server.
Conclusion
The arbitrary file write vulnerability in Jenkins Cobertura Plugin can have serious consequences if left unaddressed. It is crucial to upgrade to version 1.16 or later of the plugin to mitigate the risk of unauthorized access and data loss. Additionally, regularly monitoring and validating coverage report files can help ensure their integrity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:cobertura →
FAQ
The vulnerability allows attackers to overwrite any file on the Jenkins master file system, potentially leading to unauthorized access, data loss, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
There is no known exploit publicly available for this vulnerability at the time of writing. However, it is important to apply the recommended fix as soon as possible to prevent potential exploitation.
Yes, there are alternative code coverage plugins and tools available for Jenkins, such as JaCoCo Plugin and SonarQube. It is recommended to evaluate these alternatives based on your specific requirements and consider their security track record.
Using the vulnerable versions of the Jenkins Cobertura Plugin is not recommended due to the security risk posed by the arbitrary file write vulnerability. It is strongly advised to upgrade to version 1.16 or later to ensure the security of your Jenkins instance.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cobertura.
