CVE-2018-1000149

published 2018-04-05

CVE-2018-1000149: A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java…

Priority P4 26 medium 5.6 CVSS 3.0

AV N AC H PR N UI N S U C L I L A L

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
jenkins	ansible	<= 0.8	—
jenkins	ansible_plugin	—	—
jenkins	builds_started_before_the_plugin	—	—
jenkins	copy_to_slave_plugin	—	—
jenkins	cucumber_living_documentation_plugin	—	—
jenkins	github_pull_request_builder_plugin	—	—
jenkins	liquibase_runner_plugin	—	—
jenkins	mailer_plugin	—	—
jenkins	p4_plugin	—	—
jenkins	perforce_plugin	—	—
jenkins	reverse_proxy_auth_plugin	—	—
jenkins	we_recommend_that_users_of_perforce_plugin	—	—

CVSS provenance

nvd v3.0 5.6 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.