Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-30948

UNKNOWN
Published 2022-05-17T14:06:07
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-30948. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins Mercurial Plugin

Affected Versions:

unspecified 2.15.1

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed LOW

Path traversal in Jenkins Mercurial Plugin

GHSA-5786-3qjg-mr88

Advisory Details

SCMs support a number of different URL schemes, including local file system paths (e.g. using file: URLs). Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well. This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents

Affected Packages

Maven org.jenkins-ci.plugins:mercurial
ECOSYSTEM: ≥0 <2.16.1

CVSS Scoring

CVSS Score

2.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-30948
WEB https://github.com/jenkinsci/mercurial-plugin/commit/b995436e560b01818f5d9e9920990370cc575341
PACKAGE https://github.com/jenkinsci/mercurial-plugin
WEB https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
WEB http://www.openwall.com/lists/oss-security/2022/05/17/8

Advisory provided by GitHub Security Advisory Database. Published: May 18, 2022, Modified: December 2, 2022

References

https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
http://www.openwall.com/lists/oss-security/2022/05/17/8
Published: 2022-05-17T14:06:07
Last Modified: 2024-08-03T07:03:39.392Z
Copied to clipboard!