CVE-2019-10392
HIGHJenkins Git Client < 2.8.4 - OS Command Injection
Title source: ruleDescription
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
Exploits (3)
nomisec
WORKING POC
3 stars
by ftk-sostupid · poc
https://github.com/ftk-sostupid/CVE-2019-10392_EXP
nomisec
WRITEUP
by shoucheng3 · poc
https://github.com/shoucheng3/jenkinsci__git-client-plugin_CVE-2019-10392_2-8-4
Scores
CVSS v3
8.8
EPSS
0.8082
EPSS Percentile
99.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (3)
jenkins/git_client
3.0.0 rc
jenkins/git_client
< 2.8.4
org.jenkins-ci.plugins/git-client
0 - 2.8.5Maven
Published
Sep 12, 2019
Tracked Since
Feb 18, 2026