Jenkins Git client Plugin file system information disclosure vulnerability

中 4.3CVE-2025-58458 · GHSA-g2pq-9jr7-w6gv · 03/09/2025 公開 · 17/06/2026 更新

要点

CVE-2025-58458 は org.jenkins-ci.plugins:git-client, git client (jenkins) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 24.5% より高い）。
対処：6.3.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:git-client Maven	`< 6.3.3`	`6.3.3`
git client jenkins	`= 6.2.0≥ 6.3.0, ≤ 6.3.2≤ 6.1.3`	修正版なし

概要

In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying amazon-s3 protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

NVD の説明

In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.