Jenkins Cobertura vulnerabilities

2 CVEs affecting Jenkins Cobertura, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2139, published 2020-03-09.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-2139, published 2020-03-09. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file…
• CVE-2020-2138, published 2020-03-09. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.