Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin
High severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Dec 13, 2023
Description
Published by the National Vulnerability Database
Sep 12, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Jun 28, 2022
Last updated
Dec 13, 2023
Jenkins Git Client Plugin 2.8.4 and earlier did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
References