Vulnerability Details : CVE-2022-28142

Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.

Published 2022-03-29 13:15:08

Updated 2023-11-17 17:27:16

Source Jenkins Project

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-28142

Probability of exploitation activity in the next 30 days: 0.08%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 33 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-28142

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	nvd@nist.gov
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2022-28142

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.
Assigned by:
- jenkinsci-cert@googlegroups.com (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2022-28142

https://www.jenkins.io/security/advisory/2022-03-29/#SECURITY-2081

Jenkins Security Advisory 2022-03-29
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/03/29/1

oss-security - Multiple vulnerabilities in Jenkins plugins
Mailing List;Third Party Advisory

CVEs referencing this url

Products affected by CVE-2022-28142

Jenkins » Proxmox » For Jenkins
Versions up to, including, (<=) 0.6.0
cpe:2.3:a:jenkins:proxmox:*:*:*:*:*:jenkins:*:*
Matching versions