Lucene search

GitHub Advisory DatabaseGHSA-46RR-87H4-F5Q6

HistoryMay 24, 2022 - 5:03 p.m.

SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin

2022-05-2417:03:47

CWE-295

GitHub Advisory Database

github.com

jenkins

websphere

ssl/tls

certificate validation

global

disabled

jvm

security

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.

Affected configurations

Vulners

Node

org.jenkins-ci.pluginswebsphere-deployerRange≤1.6.1

VendorProductVersionCPE
org.jenkins-ci.pluginswebsphere-deployer*cpe:2.3:a:org.jenkins-ci.plugins:websphere-deployer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.jenkins-ci.plugins	websphere-deployer	*	cpe:2.3:a:org.jenkins-ci.plugins:websphere-deployer::::::::

References

www.openwall.com/lists/oss-security/2019/12/17/1

github.com/advisories/GHSA-46rr-87h4-f5q6

jenkins.io/security/advisory/2019-12-17/#SECURITY-1581

nvd.nist.gov/vuln/detail/CVE-2019-16561

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Related for GHSA-46RR-87H4-F5Q6