Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-30949

UNKNOWN
Published 2022-05-17T14:06:09
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-30949. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins REPO Plugin

Affected Versions:

unspecified

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed LOW

Path traversal in Jenkins REPO Plugin

GHSA-8vfc-fcr2-47pj

Advisory Details

SCMs support a number of different URL schemes, including local file system paths (e.g. using `file:` URLs). Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well. This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Affected Packages

Maven org.jenkins-ci.plugins:repo
ECOSYSTEM: ≥0 <1.14.1
Maven org.jenkins-ci.plugins:mercurial
ECOSYSTEM: ≥0 <2.16.1
Maven org.jenkins-ci.plugins:git
ECOSYSTEM: ≥0 <4.11.2

CVSS Scoring

CVSS Score

2.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-30949
WEB https://github.com/jenkinsci/git-plugin/commit/b295606e0b865c298fde27bea14f9b7535a976e6
WEB https://github.com/jenkinsci/mercurial-plugin/commit/55904fbb8c9d3e0b36fc26330374904cb68e8758
WEB https://github.com/jenkinsci/repo-plugin/commit/8c9cbb88baffc64d1b63183235eb86c773108235
PACKAGE https://github.com/jenkinsci/repo-plugin
WEB https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
WEB http://www.openwall.com/lists/oss-security/2022/05/17/8

Advisory provided by GitHub Security Advisory Database. Published: May 18, 2022, Modified: December 15, 2023

References

https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
http://www.openwall.com/lists/oss-security/2022/05/17/8
Published: 2022-05-17T14:06:09
Last Modified: 2024-08-03T07:03:39.748Z
Copied to clipboard!