exploitDog

CVE-2019-10317

Опубликовано: 30 апр. 2019

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.

Ссылки

http://www.openwall.com/lists/oss-security/2019/04/30/5
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108159
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-930
Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/5
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108159
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-930
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:sitemonitor:*:*:*:*:*:jenkins:*:*

Версия до 0.5 (включая)

EPSS

Процентиль: 20%

0.00063

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-23c2-w636-5rhm

CVSS3: 6.5

github

около 3 лет назад

Jenkins SiteMonitor Plugin globally and unconditionally disables SSL/TLS certificate validation

EPSS

Процентиль: 20%

0.00063

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295