CVE-2019-10392

2019-09-1213:55:15

jenkins

www.cve.org

9 High

AI Score

Confidence

High

0.947 High

EPSS

Percentile

99.3%

JSON

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of ‘git ls-remote’, resulting in OS command injection.

CNA Affected

[
  {
    "product": "Jenkins Git Client Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "2.8.4 and earlier, 3.0.0-rc"
      }
    ]
  }
]