PT-2018-15214 · Jenkins · Jenkins Inedo Buildmaster Plugin+1

Daniel Beck · Published 2018-08-01 · Updated 2022-05-14 · CVE-2018-1999035

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Inedo BuildMaster Plugin versions 1.3 and earlier

Description A man-in-the-middle issue exists that allows attackers to impersonate any service that Jenkins connects to. This is due to vulnerabilities in the BuildMasterConfiguration.java, BuildMasterConfig.java, and BuildMasterApi.java files.

Recommendations For Jenkins Inedo BuildMaster Plugin versions 1.3 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-1999035

GHSA-HRR3-7R5V-VXX5

Affected Products

Jenkins

Jenkins Inedo Buildmaster Plugin

References · 4

• https://osv.dev/vulnerability/CVE-2018-1999035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999035 · Security Note
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-935 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hrr3-7r5v-vxx5 · Vendor Advisory