What is GHSA-m8x2-4gc8-9v3r?

GHSA-m8x2-4gc8-9v3r is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins CollabNet Plugin man in the middle vulnerability

Which CVE IDs does GHSA-m8x2-4gc8-9v3r cover?

GHSA-m8x2-4gc8-9v3r covers the following CVE IDs: CVE-2018-1000605. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m8x2-4gc8-9v3r?

GHSA-m8x2-4gc8-9v3r has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-m8x2-4gc8-9v3r?

GHSA-m8x2-4gc8-9v3r affects 1 product, including: maven/org.jenkins-ci.plugins:collabnet:\u003c= 2.0.4.

GHSA-m8x2-4gc8-9v3rMediumCVSS 6.5

Jenkins CollabNet Plugin man in the middle vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000605 →

📋 Description

A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to. CollabNet Plugin 2.0.5 and newer no longer does that. It instead requires users to opt in to disabling SSL/TLS certificate validation by setting the system property hudson.plugins.collabnet.CollabNetPlugin.skipSslValidation to true. This feature applies to connections by this plugin only.

🎯 Affected products1

maven/org.jenkins-ci.plugins:collabnet:<= 2.0.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000605
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-941
https://github.com/advisories/GHSA-m8x2-4gc8-9v3r