CVE-2019-10382 Jenkins VMware Lab Manager Slaves Plugin vulnerable to Improper Certificate Validation
The Jenkins VMware Lab Manager Slaves Plugin disables SSL/TLS verification globally, allowing attackers to bypass security checks and potentially intercept traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10382?
CVE-2019-10382 is a medium-severity vulnerability in Jenkins VMware Lab Manager Slaves Plugin, published on 7 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.
Weakness: CWE-295
Which versions are affected by CVE-2019-10382?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:labmanager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:labmanager Maven | All versions to 0.2.8 | None |
org.jenkins-ci.plugins:labmanager Maven | All versions to 0.2.8 | None |
Products include Jenkins Vmware Lab Manager Slaves.
How do I fix CVE-2019-10382?
No fix has been published for CVE-2019-10382 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-10382 being exploited?
There is no known exploitation of CVE-2019-10382 in the wild and no public exploit code.
Other vulnerabilities in Jenkins VMware Lab Manager Slaves Plugin
Sources
Also known as GHSA-jxg7-cghf-mggx.