CVE-2022-30947 Path traversal in Jenkins Git Mercurial and Repo Plugins

What is CVE-2022-30947?

CVE-2022-30947 is a high-severity path traversal vulnerability in Jenkins Git Plugin, published on 17 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Which versions are affected by CVE-2022-30947?

6 open source packages ship an affected version, including org.jenkins-ci.plugins:git, org.jenkins-ci.plugins:mercurial and org.jenkins-ci.plugins:repo. It affects 1 product.

Products include Jenkins Git.

How do I fix CVE-2022-30947?

Upgrade org.jenkins-ci.plugins:git to 4.11.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-30947 being exploited?

There is no known exploitation of CVE-2022-30947 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Git Plugin

• CVE-2022-36882 Lack of authentication mechanism in Jenkins Git Plugin webhook High 8.8
• CVE-2022-36883 Lack of authentication mechanism in Jenkins Git Plugin webhook High 7.5
• CVE-2017-1000092 Cross-Site Request Forgery in Jenkins Git Plugin High 7.5
• CVE-2022-38663 Improper masking of credentials Jenkins in Git Plugin Medium 6.5
• CVE-2018-1000182 Server-Side Request Forgery in Jenkins Git Plugin Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-84cm-vjwm-m979.