Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin

Jenkins Git Client Plugin 2.8.4 and earlier did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

Vulnerability ID: GHSA-hw6x-2qwv-rxr7
Aliases: CVE-2019-10392
Published: 2022-05-24 16:55:58
CWE: CWE-78
Severity rating: HIGH
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven
name: org.jenkins-ci.plugins:git-client