Skip to content

Commit bb48923

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-f696-867g-2759 GHSA-g2pq-9jr7-w6gv GHSA-gm8g-fh49-qq6v GHSA-f696-867g-2759 GHSA-g2pq-9jr7-w6gv GHSA-gm8g-fh49-qq6v
1 parent 3cff43e commit bb48923

File tree

6 files changed

+200
-87
lines changed

6 files changed

+200
-87
lines changed

‎advisories/github-reviewed/2025/09/GHSA-f696-867g-2759/GHSA-f696-867g-2759.json

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f696-867g-2759",
4+
"modified": "2025-09-03T22:23:42Z",
5+
"published": "2025-09-03T15:30:34Z",
6+
"aliases": [
7+
"CVE-2025-58460"
8+
],
9+
"summary": "Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials",
10+
"details": "A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "io.jenkins.plugins:opentelemetry"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.1543.1545.vf5a"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58460"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/jenkinsci/opentelemetry-plugin/commit/f5a4ec123769096ad9a4930ede56588b0fee40f3"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/jenkinsci/opentelemetry-plugin"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/jenkinsci/opentelemetry-plugin/releases/tag/3.1543.1545.vf5a_4ec123769"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3602"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-862"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-09-03T22:23:42Z",
67+
"nvd_published_at": "2025-09-03T15:15:39Z"
68+
}
69+
}

‎advisories/github-reviewed/2025/09/GHSA-g2pq-9jr7-w6gv/GHSA-g2pq-9jr7-w6gv.json

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g2pq-9jr7-w6gv",
4+
"modified": "2025-09-03T22:22:25Z",
5+
"published": "2025-09-03T15:30:34Z",
6+
"aliases": [
7+
"CVE-2025-58458"
8+
],
9+
"summary": "Jenkins Git client Plugin file system information disclosure vulnerability",
10+
"details": "In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:git-client"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.3.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58458"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/jenkinsci/git-client-plugin/commit/20090a86c3ebc72e5283c882de73e3a4459137bb"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/jenkinsci/git-client-plugin"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3590"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-200",
59+
"CWE-538"
60+
],
61+
"severity": "MODERATE",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2025-09-03T22:22:25Z",
64+
"nvd_published_at": "2025-09-03T15:15:39Z"
65+
}
66+
}

‎advisories/github-reviewed/2025/09/GHSA-gm8g-fh49-qq6v/GHSA-gm8g-fh49-qq6v.json

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gm8g-fh49-qq6v",
4+
"modified": "2025-09-03T22:22:41Z",
5+
"published": "2025-09-03T15:30:34Z",
6+
"aliases": [
7+
"CVE-2025-58459"
8+
],
9+
"summary": "Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated",
10+
"details": "Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. \n\nThis has been patched in version 347.v32a_eb_0493c4f.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:global-build-stats"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "347.v32a"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58459"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/jenkinsci/global-build-stats-plugin/commit/32aeb0493c4ff5423448576f477ac612f7a25138"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/jenkinsci/global-build-stats-plugin"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3535"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-284"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-09-03T22:22:41Z",
63+
"nvd_published_at": "2025-09-03T15:15:39Z"
64+
}
65+
}

‎advisories/unreviewed/2025/09/GHSA-f696-867g-2759/GHSA-f696-867g-2759.json

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎advisories/unreviewed/2025/09/GHSA-g2pq-9jr7-w6gv/GHSA-g2pq-9jr7-w6gv.json

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎advisories/unreviewed/2025/09/GHSA-gm8g-fh49-qq6v/GHSA-gm8g-fh49-qq6v.json

Lines changed: 0 additions & 29 deletions
This file was deleted.

0 commit comments

Comments
 (0)