High Git Client CVEs

Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 50.0%

Critical 0 0.0% High 2 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 50.0% Forecast only 0 0.0% No public exploit 1 50.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q3 191 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 221 No exploit published1 High1 not blocked1 No public exploit1

Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2022-36881	High	2022-07-27	No exploit published	No public exploit	Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.
CVE-2019-10392	High	2019-09-12	Protected by Waratek	Proof of concept only	Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2022-36881

High

2022-07-27

No exploit published

No public exploit

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

CVE-2019-10392

High

2019-09-12

Protected by Waratek

Proof of concept only

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.