CVE-2022-30947: Path Traversal
Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
Other sources
Jenkins SCMs support a number of different URL schemes, including local file system paths (e.g. using file: URLs).
Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well.
This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30947?
CVE-2022-30947 has a medium severity rating, indicating potential risks to the information contained in the Jenkins environment.
How do I fix CVE-2022-30947?
To fix CVE-2022-30947, upgrade the Jenkins Git Plugin to version 4.11.2 or later, the Mercurial Plugin to version 2.16.1, and the Repo Plugin to version 1.15.0.
What versions are affected by CVE-2022-30947?
CVE-2022-30947 affects Jenkins Git Plugin versions 4.11.1 and earlier, Mercurial Plugin versions 2.16 and earlier, and Repo Plugin versions 1.14.0 and earlier.
What is the impact of CVE-2022-30947?
The impact of CVE-2022-30947 allows attackers to access limited information about other projects' source code management contents if they can configure pipelines.
Who is at risk with CVE-2022-30947?
Organizations using Jenkins with the affected plugin versions for Git, Mercurial, or Repo are at risk for data exposure through this vulnerability.