PT-2022-20401 · Jenkins · Jenkins Git Plugin+1

Daniel Beck · Published 2022-05-17 · Updated 2024-01-09 · CVE-2022-30947

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Plugin versions 4.11.1 and earlier

Description The issue allows attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs. This enables them to obtain limited information about other projects' SCM contents. Historically, Jenkins only had agents checking out from SCM, and there was no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well, which contributes to this issue.

Recommendations For Jenkins Git Plugin versions 4.11.1 and earlier, consider updating to a version later than 4.11.1 to resolve the issue. As a temporary workaround, restrict the configuration of pipelines to trusted users and limit the use of local paths as SCM URLs to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-30947

GHSA-84CM-VJWM-M979

Affected Products

Jenkins

Jenkins Git Plugin

References · 11

• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2478 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30947 · Security Note
• https://osv.dev/vulnerability/GHSA-84cm-vjwm-m979 · Vendor Advisory
• https://github.com/jenkinsci/git-plugin/commit/b295606e0b865c298fde27bea14f9b7535a976e6 · Note
• https://github.com/jenkinsci/git-plugin · Note
• https://github.com/jenkinsci/mercurial-plugin/commit/55904fbb8c9d3e0b36fc26330374904cb68e8758 · Note
• https://github.com/jenkinsci/repo-plugin/commit/3c8e6236b1088fc138a1a3e6af5ebbcb8b616f2f · Note
• http://openwall.com/lists/oss-security/2022/05/17/8 · Note
• https://t.me/cvenotify/66716 · Telegram Post
• https://t.me/cibsecurity/42821 · Telegram Post