CVE-2022-30948

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-17 · updated 2026-06-17

Description

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Affected products

Jenkins project Jenkins Mercurial Plugin: before 2.16.1 — fixed in 2.16.1

How to fix

Upgrade to a fixed version: Jenkins project Jenkins Mercurial Plugin 2.16.1. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2022/05/17/8
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478
http://www.openwall.com/lists/oss-security/2022/05/17/8
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478

Get alerted when CVE-2022-30948 or the next vulnerability affects your stack