GHSA-g2pq-9jr7-w6gv

Source

https://github.com/advisories/GHSA-g2pq-9jr7-w6gv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-g2pq-9jr7-w6gv/GHSA-g2pq-9jr7-w6gv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g2pq-9jr7-w6gv

Aliases

CVE-2025-58458

Published

2025-09-03T15:30:34Z

Modified

2025-11-05T20:52:32Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Jenkins Git client Plugin file system information disclosure vulnerability

Details

In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying amazon-s3 protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Database specific

{
    "cwe_ids":  [
        "CWE-200",
        "CWE-538"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-03T22:22:25Z",
    "nvd_published_at":  "2025-09-03T15:15:39Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:git-client

Package

Name: org.jenkins-ci.plugins:git-client; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/git-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.3.3

Affected versions

1.*

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.1

1.1.1

1.1.2

1.2.0

1.3.0

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.7.0

1.8.0

1.8.1

1.9.0

1.9.1

1.9.2

1.10.0

1.10.1

1.10.2

1.11.0

1.11.1

1.12.0

1.13.0

1.14.0

1.14.1

1.15.0

1.16.1

1.17.0

1.17.1

1.18.0

1.19.0

1.19.1

1.19.2

1.19.3

1.19.4

1.19.5

1.19.6

1.19.7

1.20.0-beta1

1.20.0-beta2

1.20.0-beta3

1.20.2

1.21.0

2.*

2.0.0-beta1

2.0.0-beta2

2.0.0-beta3

2.0.0-beta4

2.0.0

2.1.0

2.2.0

2.2.1

2.3.0

2.4.0

2.4.1

2.4.2

2.4.4

2.4.5

2.4.6

2.5.0

2.6.0

2.7.0

2.7.1

2.7.2

2.7.3

2.7.3.1

2.7.4

2.7.4.1

2.7.5

2.7.6

2.7.7

2.7.7.1

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.9.0

3.*

3.0.0-beta1

3.0.0-beta2

3.0.0-beta3

3.0.0-beta4

3.0.0-beta5

3.0.0-beta6

3.0.0-beta7

3.0.0-beta8

3.0.0-beta9

3.0.0-beta10

3.0.0-beta11

3.0.0-beta12

3.0.0-rc

3.0.0

3.1.0-beta

3.1.0

3.1.1

3.2.0

3.2.1

3.3.0

3.3.1

3.3.2

3.4.0

3.4.1

3.4.2

3.5.0

3.5.1

3.6.0

3.7.0

3.7.1

3.7.2

3.8.0

3.9.0

3.10.0

3.10.0.1

3.10.0.2

3.10.1

3.11.0

3.11.1

3.11.2

3.12.0

3.12.1

3.12.2

3.12.4

3.13.0

3.13.1

4.*

4.0.0

4.1.0

4.2.0

4.3.0

4.4.0

4.5.0

4.6.0

4.7.0

5.*

5.0.0

5.0.1

5.0.2

5.0.3

6.*

6.0.0

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.2.0

6.2.1

6.3.0

6.3.1

6.3.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-g2pq-9jr7-w6gv/GHSA-g2pq-9jr7-w6gv.json"