Not rated
CVE-2022-30947 Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories…
Description
Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Git Plugin 4.11 | earliest → 4.11.1 | No fix stated |
| Jenkins Git Plugin 4.9 | earliest → < 4.9.1 | 4.9.1 |
References
- www.jenkins.io www.jenkins.io
- [oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Jenkins Git Plugin
The 7 CVEs of Jenkins Git Plugin →
CVE-2022-38663
Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log…
Not rated
CVE-2022-36884
The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the…
Not rated
CVE-2022-36883
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds…
Not rated
CVE-2022-36882
A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger…
Not rated