PT-2025-35780 · Jenkins · Jenkins Git Client Plugin+1

Daniel Beck · Published 2025-09-03 · Updated 2025-09-08 · CVE-2025-58458

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git client Plugin versions 6.3.2 and earlier

Description The Git URL field form validation responses differ based on whether the specified file path exists on the Jenkins controller when using the amazon-s3 protocol with JGit. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Recommendations Upgrade Jenkins Git client Plugin to a version later than 6.3.2.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-538

Related Identifiers

CVE-2025-58458

GHSA-G2PQ-9JR7-W6GV

Affected Products

Jenkins

Jenkins Git Client Plugin

References · 10

• https://osv.dev/vulnerability/GHSA-g2pq-9jr7-w6gv · Vendor Advisory
• https://jenkins.io/security/advisory/2025-09-03/#SECURITY-3590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58458 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58458 · Vendor Advisory
• https://github.com/jenkinsci/git-client-plugin/commit/20090a86c3ebc72e5283c882de73e3a4459137bb · Note
• https://github.com/jenkinsci/git-client-plugin · Note
• https://twitter.com/CVEnew/status/1963264350254399759 · Twitter Post
• https://t.me/cveNotify/134266 · Telegram Post
• https://t.me/cveNotify/134659 · Telegram Post
• http://openwall.com/lists/oss-security/2025/09/03/4 · Note