Jenkins CollabNet Plugin man in the middle vulnerability

2022-05-1402:56:39

Google

osv.dev

0.001 Low

EPSS

Percentile

49.0%

JSON

A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to. CollabNet Plugin 2.0.5 and newer no longer does that. It instead requires users to opt in to disabling SSL/TLS certificate validation by setting the system property hudson.plugins.collabnet.CollabNetPlugin.skipSslValidation to true. This feature applies to connections by this plugin only.

CPENameOperatorVersion
org.jenkins-ci.plugins:collabneteq2.0.2
org.jenkins-ci.plugins:collabneteq1.1.7
org.jenkins-ci.plugins:collabneteq1.1.8
org.jenkins-ci.plugins:collabneteq2.0.3
org.jenkins-ci.plugins:collabneteq1.2.0
org.jenkins-ci.plugins:collabneteq2.0.1
org.jenkins-ci.plugins:collabneteq1.1.10
org.jenkins-ci.plugins:collabneteq1.1.6
org.jenkins-ci.plugins:collabneteq2.0.4
org.jenkins-ci.plugins:collabneteq1.1.9

Name	Operator	Version
org.jenkins-ci.plugins:collabnet	eq	2.0.2
org.jenkins-ci.plugins:collabnet	eq	1.1.7
org.jenkins-ci.plugins:collabnet	eq	1.1.8
org.jenkins-ci.plugins:collabnet	eq	2.0.3
org.jenkins-ci.plugins:collabnet	eq	1.2.0
org.jenkins-ci.plugins:collabnet	eq	2.0.1
org.jenkins-ci.plugins:collabnet	eq	1.1.10
org.jenkins-ci.plugins:collabnet	eq	1.1.6
org.jenkins-ci.plugins:collabnet	eq	2.0.4
org.jenkins-ci.plugins:collabnet	eq	1.1.9