PT-2023-2501 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin+1

Pavel Nakonechnyi · Published 2023-04-12 · Updated 2025-02-07 · CVE-2023-30517

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier

Description The issue is related to improper SSL/TLS certificate authentication. It may allow a remote attacker to gain unauthorized access to protected information. The plugin unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.

Recommendations For Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier, update to a version that conditionally enables SSL/TLS certificate and hostname validation to prevent unauthorized access. As a temporary workaround, consider restricting access to the plugin until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-297

Related Identifiers

BDU:2023-02295

CVE-2023-30517

GHSA-R3MM-V4X7-2PHM

Affected Products

Jenkins

Jenkins Neuvector Vulnerability Scanner Plugin

References · 10

• https://osv.dev/vulnerability/GHSA-r3mm-v4x7-2phm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30517 · Security Note
• https://jenkins.io/security/advisory/2023-04-12/#SECURITY-2841 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-30517 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02295 · Security Note
• https://t.me/cibsecurity/61999 · Telegram Post
• http://openwall.com/lists/oss-security/2023/04/13/3 · Note
• https://cybersecurity-help.cz/vdb/SB2023041324 · Note
• https://t.me/cvenotify/110437 · Telegram Post
• https://t.me/cvenotify/48801 · Telegram Post