CVE-2025-58458
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-09-03
Last updated on: 2025-11-04
Assigner: Jenkins Project
Description
Description
In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | git_client | to 6.1.3 (inc) |
| jenkins | git_client | From 6.3.0 (inc) to 6.3.2 (inc) |
| jenkins | git_client | 6.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-538 | The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
