PT-2023-2501 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin+1

Pavel Nakonechnyi · Publicado 2023-04-12 · Atualizado 2025-02-07 · CVE-2023-30517

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier

Description The issue is related to improper SSL/TLS certificate authentication. It may allow a remote attacker to gain unauthorized access to protected information. The plugin unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.

Recommendations For Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier, update to a version that conditionally enables SSL/TLS certificate and hostname validation to prevent unauthorized access. As a temporary workaround, consider restricting access to the plugin until a patch is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

CWE-297

Identificadores relacionados

BDU:2023-02295

CVE-2023-30517

GHSA-R3MM-V4X7-2PHM

Produtos afetados

Jenkins

Jenkins Neuvector Vulnerability Scanner Plugin

Referências · 10

• https://t.me/cibsecurity/61999 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/04/13/3 · Nota
• https://osv.dev/vulnerability/GHSA-r3mm-v4x7-2phm · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023041324 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30517 · Nota de Segurança
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-2841 · Aviso do Fabricante
• https://t.me/cvenotify/110437 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-30517 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02295 · Nota de Segurança
• https://t.me/cvenotify/48801 · Publicação no Telegram