Insufficient Access Control in Jenkins Mercurial Plugin
CVE-2022-30948

7.5HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Mercurial Plugin
Vendor
CVE Published:
17 May 2022

Summary

The Jenkins Mercurial Plugin version 2.16 and older versions have a vulnerability that allows users who can configure pipelines to access and check out certain source control management (SCM) repositories using local file system paths. This can lead to unauthorized access to project information stored within the Jenkins controller, potentially exposing sensitive data from other projects. This vulnerability highlights the importance of secure path handling and proper access control mechanisms within CI/CD environments.

Affected Version(s)

Jenkins Mercurial Plugin <= 2.16

Jenkins Mercurial Plugin 2.15.1

References

https://www.jenkins.io/security/advisory/2022-05-17/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/05/17/8
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.