4.3
CVE-2025-58458
- EPSS 0.31%
- Veröffentlicht 03.09.2025 15:02:26
- Zuletzt bearbeitet 04.11.2025 22:16:34
- Erkennungen
LoginIn Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jenkins ≫ Git Client SwPlatform jenkins Version <= 6.1.3
Jenkins ≫ Git Client SwPlatform jenkins Version >= 6.3.0 <= 6.3.2
Jenkins ≫ Git Client Version 6.2.0 SwPlatform jenkins
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.31% | 0.232 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| CISA-ADP | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3590
http://www.openwall.com/lists/oss-security/2025/09/03/4