PT-2022-20403 · Jenkins · Jenkins Repo Plugin+1

Daniel Beck · Published 2022-05-17 · Updated 2023-12-21 · CVE-2022-30949

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins REPO Plugin versions 1.14.0 and earlier

Description The issue allows attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs. This enables them to obtain limited information about other projects' SCM contents. Historically, in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well. SCMs support a number of different URL schemes, including local file system paths, such as using file: URLs.

Recommendations For Jenkins REPO Plugin versions 1.14.0 and earlier, consider updating to a version later than 1.14.0 to resolve the issue. As a temporary workaround, restrict the configuration of pipelines to trusted users to minimize the risk of exploitation. Additionally, restrict access to the Jenkins controller's file system to prevent unauthorized checkout of SCM repositories.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-30949

GHSA-8VFC-FCR2-47PJ

Affected Products

Jenkins

Jenkins Repo Plugin

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-30949 · Security Note
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-2478 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30949 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vfc-fcr2-47pj · Vendor Advisory
• https://github.com/jenkinsci/git-plugin/commit/b295606e0b865c298fde27bea14f9b7535a976e6 · Note
• https://github.com/jenkinsci/mercurial-plugin/commit/55904fbb8c9d3e0b36fc26330374904cb68e8758 · Note
• https://github.com/jenkinsci/repo-plugin · Note
• https://github.com/jenkinsci/repo-plugin/commit/8c9cbb88baffc64d1b63183235eb86c773108235 · Note
• http://openwall.com/lists/oss-security/2022/05/17/8 · Note
• https://t.me/cvenotify/64782 · Telegram Post
• https://t.me/cvenotify/30309 · Telegram Post