Git Client
Monthly
Command injection in the Jenkins Git client Plugin 6.4.0 and earlier allows a user who can influence the name of a job's workspace directory to execute arbitrary OS commands on the Jenkins controller or build agent, because the plugin fails to escape that path when it is embedded as an argument in a temporary shell script. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) shows this is not unauthenticated exploitation: the attacker needs authenticated, configuration-level access sufficient to set or control a custom workspace path, and the high attack-complexity rating reflects that merely reaching Jenkins is not enough - the workspace naming condition must be specifically achieved. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and EPSS is low at approximately 0.21% (11th percentile), so this is a genuine but low-priority vulnerability whose real-world risk is concentrated in multi-tenant Jenkins instances where less-trusted users can define job and workspace settings.
In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Command injection in the Jenkins Git client Plugin 6.4.0 and earlier allows a user who can influence the name of a job's workspace directory to execute arbitrary OS commands on the Jenkins controller or build agent, because the plugin fails to escape that path when it is embedded as an argument in a temporary shell script. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) shows this is not unauthenticated exploitation: the attacker needs authenticated, configuration-level access sufficient to set or control a custom workspace path, and the high attack-complexity rating reflects that merely reaching Jenkins is not enough - the workspace naming condition must be specifically achieved. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and EPSS is low at approximately 0.21% (11th percentile), so this is a genuine but low-priority vulnerability whose real-world risk is concentrated in multi-tenant Jenkins instances where less-trusted users can define job and workspace settings.
In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.