CVE-2019-10446 — Improper Certificate Validation in Jenkins Cadence Vmanager

CWE-295 — Improper Certificate Validation5 documents5 sources
Severity
8.2HIGHNVD
EPSS
0.1%
top 84.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Cadence VmanagerJenkins Project Jenkins Cadence Vmanager Plugin
Timeline
PublishedOct 16
Latest updateMay 24

Description

Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NExploitability: 3.9 | Impact: 4.2

Affected Packages2 packages

🔴Vulnerability Details

3
OSV
Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification↗2022-05-24
▶
GHSA
Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification↗2022-05-24
▶
CVEList
CVE-2019-10446: Jenkins Cadence vManager Plugin 2↗2019-10-16
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2019-10-16↗2019-10-16
▶
CVE-2019-10446 — Improper Certificate Validation | cvebase