Not rated
CVE-2019-10334 Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master…
Description
Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins ElectricFlow Plugin | Versions not published |
References
- [oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins www.openwall.com
- 108747 www.securityfocus.com
- jenkins.io jenkins.io
Timeline
- Published
- Last modified
Other CVEs of Jenkins ElectricFlow Plugin
The 6 CVEs of Jenkins ElectricFlow Plugin →
CVE-2019-10331
A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in…
Not rated
CVE-2019-10332
A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed…
Not rated
CVE-2019-10333
Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users…
Not rated
CVE-2019-10335
A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to…
Not rated