CVE-2022-36881

2022-07-2715:15:08

Google

osv.dev

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.5%

JSON

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

CPENameOperatorVersion
git-client-plugineqgit-client-1.1
git-client-plugineqgit-client-1.10.2
git-client-plugineqgit-client-1.4.1
git-client-plugineqgit-client-3.6.0
git-client-plugineqgit-client-3.7.2
git-client-plugineqgit-client-1.10.1
git-client-plugineqgit-client-1.0.2
git-client-plugineqgit-client-1.4.2
git-client-plugineqgit-client-3.0.0-beta2
git-client-plugineqgit-client-3.10.0

Name	Operator	Version
git-client-plugin	eq	git-client-1.1
git-client-plugin	eq	git-client-1.10.2
git-client-plugin	eq	git-client-1.4.1
git-client-plugin	eq	git-client-3.6.0
git-client-plugin	eq	git-client-3.7.2
git-client-plugin	eq	git-client-1.10.1
git-client-plugin	eq	git-client-1.0.2
git-client-plugin	eq	git-client-1.4.2
git-client-plugin	eq	git-client-3.0.0-beta2
git-client-plugin	eq	git-client-3.10.0