Search for packages
| purl | pkg:maven/org.jenkins-ci.plugins/git@4.11.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-a88b-qg5x-2kdu
Aliases: CVE-2022-30949 GHSA-8vfc-fcr2-47pj |
Path traversal in Jenkins REPO Plugin SCMs support a number of different URL schemes, including local file system paths (e.g. using `file:` URLs). Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well. This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents. |
Affected by 0 other vulnerabilities. |
|
VCID-c2jh-gx5w-mqcd
Aliases: CVE-2022-30948 GHSA-5786-3qjg-mr88 |
Path traversal in Jenkins Mercurial Plugin SCMs support a number of different URL schemes, including local file system paths (e.g. using file: URLs). Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well. This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents | There are no reported fixed by versions. |
|
VCID-njg6-m67f-bfb9
Aliases: CVE-2022-30947 GHSA-84cm-vjwm-m979 |
Path traversal in Jenkins Git Mercurial and Repo Plugins Jenkins SCMs support a number of different URL schemes, including local file system paths (e.g. using `file:` URLs). Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well. This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-04T14:31:54.589301+00:00 | GHSA Importer | Affected by | VCID-njg6-m67f-bfb9 | https://github.com/advisories/GHSA-84cm-vjwm-m979 | 38.1.0 |
| 2026-04-03T21:26:04.144138+00:00 | GitLab Importer | Affected by | VCID-a88b-qg5x-2kdu | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins/git/CVE-2022-30949.yml | 38.1.0 |
| 2026-04-03T21:25:56.505131+00:00 | GitLab Importer | Affected by | VCID-c2jh-gx5w-mqcd | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins/git/CVE-2022-30948.yml | 38.1.0 |