PT-2018-15214 · Jenkins · Jenkins Inedo Buildmaster Plugin+1

Daniel Beck · Publicado 2018-08-01 · Atualizado 2022-05-14 · CVE-2018-1999035

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Inedo BuildMaster Plugin versions 1.3 and earlier

Description A man-in-the-middle issue exists that allows attackers to impersonate any service that Jenkins connects to. This is due to vulnerabilities in the BuildMasterConfiguration.java, BuildMasterConfig.java, and BuildMasterApi.java files.

Recommendations For Jenkins Inedo BuildMaster Plugin versions 1.3 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2018-1999035

GHSA-HRR3-7R5V-VXX5

Produtos afetados

Jenkins

Jenkins Inedo Buildmaster Plugin

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-1999035 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999035 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-935 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hrr3-7r5v-vxx5 · Aviso do Fabricante