GHSA-g2pq-9jr7-w6gvMediumCVSS 4.3

Jenkins Git client Plugin file system information disclosure vulnerability

Published
September 3, 2025
Last Modified
November 5, 2025

🔗 CVE IDs covered (1)

📋 Description

In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying amazon-s3 protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:git-client:< 6.3.3

🔗 References (5)