CVE-2022-30948: Path traversal in Jenkins Mercurial Plugin
Summary
CVE-2022-30948: Path traversal in Jenkins Mercurial Plugin. Affects org.jenkins-ci.plugins:mercurial versions < 2.16.1. Fixed in 2.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Mercurial Plugin is a Maven package that provides support for Mercurial as a source code management (SCM) system in Jenkins. It allows users to configure pipelines to check out repositories stored on the Jenkins controller's file system using local paths as SCM URLs. This plugin is commonly used in Jenkins instances for version control and build automation.
Vulnerability Detail
The vulnerability identified as CVE-2022-30948 is a path traversal issue in the Jenkins Mercurial Plugin. It arises from the support for local file system paths (e.g., using file: URLs) in SCMs. Attackers with the ability to configure pipelines can exploit this vulnerability to check out SCM repositories stored on the Jenkins controller's file system, gaining limited access to information about other projects' SCM contents. While this vulnerability does not directly lead to remote code execution or privilege escalation, it can still pose a risk to the confidentiality of sensitive source code and project information.
How To Fix
Minimum fixed version
2.16.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the Jenkins Mercurial Plugin is not immediately feasible, a temporary workaround is to disable the use of local file system paths as SCM URLs. Instead, use other supported URL schemes, such as HTTP or SSH, to access SCM repositories. This can be achieved by modifying the pipeline configuration to specify the appropriate URL scheme for the repository.
Conclusion
The path traversal vulnerability in the Jenkins Mercurial Plugin can potentially expose sensitive source code and project information to attackers with the ability to configure pipelines. It is crucial to upgrade the plugin to version 2.16.1 or higher to mitigate this risk. If immediate upgrading is not possible, disabling the use of local file system paths as SCM URLs can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mercurial →
FAQ
The vulnerability allows attackers to gain limited access to information about other projects' SCM contents stored on the Jenkins controller's file system. This can potentially expose sensitive source code and project information, compromising the confidentiality of the affected projects.
No, this vulnerability requires the ability to configure pipelines in Jenkins. It cannot be exploited remotely without prior access to the Jenkins instance.
No, versions up to and including 2.16 are affected. The vulnerability has been fixed in version 2.16.1 and higher.
There is no known evidence of active exploitation of this vulnerability at the time of this report. However, it is recommended to apply the necessary fixes to mitigate the risk.
Yes, the CVSS score for this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mercurial.
