PT-2019-11719 · Jenkins · Jenkins Sitemonitor Plugin+1

Daniel Beck · Published 2019-04-30 · Updated 2023-10-25 · CVE-2019-10317

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SiteMonitor Plugin version 0.5 and earlier

Description The issue concerns the Jenkins SiteMonitor Plugin, which unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. This means that the plugin does not verify the identity of the server it is connecting to, making it vulnerable to man-in-the-middle attacks. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For Jenkins SiteMonitor Plugin version 0.5 and earlier, update the plugin to a version that has the opt-in option to ignore SSL/TLS errors for each site check individually, as the newer version no longer unconditionally disables SSL/TLS certificate validation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-10317

GHSA-23C2-W636-5RHM

Affected Products

Jenkins

Jenkins Sitemonitor Plugin

References · 7

• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-930 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-23c2-w636-5rhm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10317 · Security Note
• http://openwall.com/lists/oss-security/2019/04/30/5 · Note
• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Note
• http://securityfocus.com/bid/108159 · Note