WaratekVRT Sign in

High Jenkins Git CVEs

17 CVEs, 2 exploited, 2 protected by Waratek

Reset
More filters (2)
Columns
Vendor jenkins✕Product git✕
Overview 17 matches · 2 protected · 2 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
17matches 2protected11.8% 2exploited11.8% 0CISA KEV0.0% 3public PoC17.6% 1EPSS ≥ 0.55.9%
Protected by Waratek 2 11.8% Rule in development 0 0.0% Mitigation candidate 2 11.8% No exploit published 13 76.5%
Critical 0 0.0% High 17 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 11.8% partly blocked 0 0.0% not blocked 15 88.2% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 11.8% Working exploit published 0 0.0% Proof of concept only 1 5.9% Forecast only 0 0.0% No public exploit 14 82.4%
split by peak 5 / year
No exploit published: 13Mitigation candidate: 2Protected by Waratek: 2 High: 17 not blocked: 15blocked by ARMR today: 2 No public exploit: 14Proof of concept only: 1Exploited: 2
20171 No exploit published1 High1 not blocked1 No public exploit1 20182 Mitigation candidate1 No exploit published1 High2 not blocked2 Exploited1 No public exploit1 20195 Protected by Waratek1 No exploit published4 High5 blocked by ARMR today1 not blocked4 Proof of concept only1 No public exploit4 20202 No exploit published2 High2 not blocked2 No public exploit2 20210 20224 Protected by Waratek1 Mitigation candidate1 No exploit published2 High4 blocked by ARMR today1 not blocked3 Exploited1 No public exploit3 20231 No exploit published1 High1 not blocked1 No public exploit1 20241 No exploit published1 High1 not blocked1 No public exploit1 20251 No exploit published1 High1 not blocked1 No public exploit1
201720182019202020212022202320242025
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-53652 High 2025-07-09 No exploit published No public exploit Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters.
CVE-2024-28157 High 2024-03-06 No exploit published No public exploit Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVE-2023-24434 High 2023-01-26 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2022-36883 High 2022-07-27 Mitigation candidate Exploited A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVE-2022-36882 High 2022-07-27 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.
CVE-2022-36881 High 2022-07-27 No exploit published No public exploit Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
CVE-2022-30947 High 2022-05-17 Protected by Waratek No public exploit Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2020-2228 High 2020-07-15 No exploit published No public exploit Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
CVE-2020-2116 High 2020-02-12 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10392 High 2019-09-12 Protected by Waratek Proof of concept only Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
CVE-2019-10371 High 2019-08-07 No exploit published No public exploit A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
CVE-2019-10315 High 2019-04-30 No exploit published No public exploit Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.
CVE-2019-10301 High 2019-04-18 No exploit published No public exploit A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10300 High 2019-04-18 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2018-1000600 High 2018-06-26 Mitigation candidate Exploited A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2018-1000142 High 2018-04-05 No exploit published No public exploit An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.
CVE-2017-1000092 High 2017-10-05 No exploit published No public exploit Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.