CVE-2019-16561

published 2019-12-17

CVE-2019-16561: Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire…

Priority P4 32 high 7.1 CVSS 3.1

AV N AC L PR L UI N S U C H I L A N

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
jenkins	alauda_devops_pipeline_plugin	—	—
jenkins	alauda_kubernetes_suport_plugin	—	—
jenkins	build_failure_analyzer_plugin	—	—
jenkins	gerrit_trigger_plugin	—	—
jenkins	ids_in_team_concert_plugin	—	—
jenkins	ids_to_allow_users_configuring_the_plugin	—	—
jenkins	jenkins_and_plugin	—	—
jenkins	mantis_plugin	—	—
jenkins	maven_release_plug-in_plugin	—	—
jenkins	mission_control_plugin	—	—
jenkins	pipeline_aggregator_view_plugin	—	—
jenkins	rapiddeploy_plugin	—	—
jenkins	redgate_sql_change_automation_plugin	—	—
jenkins	rundeck_plugin	—	—
jenkins	sctmexecutor_plugin	—	—
jenkins	spira_importer_plugin	—	—
jenkins	team_concert_plugin	—	—
jenkins	websphere_deployer	<= 1.6.1	—
jenkins	websphere_deployer_plugin	—	—
jenkins	weibo_plugin	—	—
jenkins_project	jenkins_websphere_deployer_plugin	unspecified – 1.6.1	—

CVSS provenance

nvd v3.1 7.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-295