CVE-2019-10392

2019-09-1214:15:11

Google

osv.dev

7 High

AI Score

Confidence

High

0.947 High

EPSS

Percentile

99.3%

JSON

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of ‘git ls-remote’, resulting in OS command injection.

CPENameOperatorVersion
git-client-plugineqgit-client-2.0.0-beta1
git-client-plugineqgit-client-2.7.6
git-client-plugineqgit-client-3.0.0-beta1
git-client-plugineqgit-client-1.0.6
git-client-plugineqgit-client-2.4.0
git-client-plugineqgit-client-1.6.6
git-client-plugineqgit-client-1.5.0
git-client-plugineqgit-client-2.2.0
git-client-plugineqgit-client-1.20.0
git-client-plugineqgit-client-2.8.1

Name	Operator	Version
git-client-plugin	eq	git-client-2.0.0-beta1
git-client-plugin	eq	git-client-2.7.6
git-client-plugin	eq	git-client-3.0.0-beta1
git-client-plugin	eq	git-client-1.0.6
git-client-plugin	eq	git-client-2.4.0
git-client-plugin	eq	git-client-1.6.6
git-client-plugin	eq	git-client-1.5.0
git-client-plugin	eq	git-client-2.2.0
git-client-plugin	eq	git-client-1.20.0
git-client-plugin	eq	git-client-2.8.1