CVE-2018-1000151

published 2018-04-05

CVE-2018-1000151: A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default.

Priority P4 25 medium 5.6 CVSS 3.0

AV N AC H PR N UI N S U C L I L A L

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
jenkins	ansible_plugin	—	—
jenkins	builds_started_before_the_plugin	—	—
jenkins	copy_to_slave_plugin	—	—
jenkins	cucumber_living_documentation_plugin	—	—
jenkins	github_pull_request_builder_plugin	—	—
jenkins	liquibase_runner_plugin	—	—
jenkins	mailer_plugin	—	—
jenkins	p4_plugin	—	—
jenkins	perforce_plugin	—	—
jenkins	reverse_proxy_auth_plugin	—	—
jenkins	vsphere	<= 2.16	—
jenkins	we_recommend_that_users_of_perforce_plugin	—	—

CVSS provenance

nvd v3.0 5.6 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-295