Description

A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.

Remediation

References

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-933

Related Vulnerabilities

CVE-2022-36094 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates

CVE-2019-10455 Vulnerability in maven package org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic

CVE-2023-24434 Vulnerability in maven package org.jenkins-ci.plugins:ghprb

CVE-2021-1627 Vulnerability in maven package org.mule.runtime:mule

CVE-2020-1717 Vulnerability in maven package org.keycloak:keycloak-parent

Severity

High

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Vendor Advisory CWE-295