« Volver al listado

CVE-2025-58458

Estado: ModificadaMedia (4.3)—

In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — GIT Client

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-58458",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-58458",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-03T15:39:03.501942Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "affectedData": [
        {
          "vendor": "Jenkins Project",
          "product": "Jenkins Git client Plugin",
          "versions": [
            {
              "status": "unaffected",
              "version": "6.3.3",
              "lessThan": "*",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "6.1.4",
              "lessThan": "6.1.*",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "6.2.1",
              "lessThan": "6.2.*",
              "versionType": "maven"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-09-03T15:15:39.520",
  "references": [
    {
      "url": "https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3590",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/09/03/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-538"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system."
    }
  ],
  "lastModified": "2026-06-17T09:44:29.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:git_client:*:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "902589A1-E018-4AE6-BA6E-6F69A22B73A4",
              "versionEndIncluding": "6.1.3"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:git_client:*:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F63091DA-F54C-42D0-8E04-6C5AD7574377",
              "versionEndIncluding": "6.3.2",
              "versionStartIncluding": "6.3.0"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:git_client:6.2.0:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE5FE0B1-18C8-44EA-AF27-359A5EF52693"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "jenkinsci-cert@googlegroups.com"
}