CVE-2023-30517

MEDIUM5.9EPSS 0.04%

Jenkins NeuVector Vulnerability Scanner Plugin disables SSL/TLS certificate and hostname validation

Published: 4/12/2023Modified: 11/8/2023

Description

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.

Affected packages (1)

Maven/io.jenkins.plugins:neuvector-vulnerability-scannerfrom 0, <= 1.22

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.9	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-30517
WEBhttps://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2841
WEBhttp://www.openwall.com/lists/oss-security/2023/04/13/3