4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58458

CVE-2025-58458: Jenkins Git client Plugin file system information disclosure vulnerability

In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying amazon-s3 protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58458

CVE-2025-58458:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:git-client	maven	< 6.3.3	6.3.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the JGitAPIImpl class in the Jenkins Git client Plugin did not properly validate the protocol of URLs passed to it. Specifically, it allowed URLs with the amazon-s3: protocol. The underlying JGit library's implementation for this protocol (TransportAmazonS3) has a side effect of checking for the existence of local file paths on the filesystem, which is intended for accessing S3-compatible storage via local configuration files. However, when exposed through the Jenkins UI, this behavior becomes an information disclosure vulnerability, as an attacker with sufficient permissions to configure a Git repository URL could use it to probe for the existence of arbitrary files and directories on the Jenkins controller.

The patch addresses this by introducing a helper method, unsupportedProtocol(String url), which explicitly checks for and rejects any URL starting with amazon-s3:. This check is then applied in every public method within JGitAPIImpl that accepts a remote repository URL as an argument. This prevents the vulnerable TransportAmazonS3 class from ever being invoked, thus closing the information disclosure vector. The identified vulnerable functions are all the public methods that were modified to include this new validation check, as they were the entry points for the malicious URL.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.