GitHub Advisoryadvisory · Maven

GHSA-h5hm-73hg-frrm Jenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation

HIGH Published 2022-05-14 Modified 2024-01-30 Official page ↗
Aliases
CVE-2018-1999034
Ecosystem
Maven
Packages
com.inedo.proget:inedo-proget
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2024-01-30

Affected packages

• Maven com.inedo.proget:inedo-proget: < 1.0 → fixed in 1.0

Description

A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.

Related

Alias · CVE (1)

  • CVE-2018-1999034 A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java,… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References