CVE-2019-10444
Quick assessment
Affected
Jenkins project Jenkins Bumblebee HP ALM Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CloudBees Jenkins（Hudson Labs）是美国CloudBees公司的一套基于Java开发的持续集成工具。该产品主要用于监控持续的软件版本发布/测试项目和一些定时执行的任务。Bumblebee HP ALM Plugin是使用在其中的一个用于集成HP ALM（应用程序生命周期管理）与测试框架的插件。 CloudBees Jenkins中的Bumblebee HP ALM Plugin 4.1.3及之前版本存在信任管理问题漏洞。该漏洞源于网络系统或产品中缺乏有效的信任管理机制。攻击者可利
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-10444
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
CloudBees Jenkins Bumblebee HP ALM Plugin 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CloudBees Jenkins（Hudson Labs）是美国CloudBees公司的一套基于Java开发的持续集成工具。该产品主要用于监控持续的软件版本发布/测试项目和一些定时执行的任务。Bumblebee HP ALM Plugin是使用在其中的一个用于集成HP ALM（应用程序生命周期管理）与测试框架的插件。 CloudBees Jenkins中的Bumblebee HP ALM Plugin 4.1.3及之前版本存在信任管理问题漏洞。该漏洞源于网络系统或产品中缺乏有效的信任管理机制。攻击者可利
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Jenkins project | Jenkins Bumblebee HP ALM Plugin | 4.1.3 and earlier | - |
|
II. Public POCs for CVE-2019-10444
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-10444
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-10444 (1)
-
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1481 x_refsource_CONFIRM
Same Patch Batch · Jenkins project · 2019-10-16 · 23 CVEs total
| CVE-2019-10448 | CloudBees Jenkins Extensive Testing Plugin 安全漏洞 | |
| CVE-2019-10437 | CloudBees Jenkins CRX Content Package Deployer Plugin 跨站请求伪造漏洞 | |
| CVE-2019-10436 | CloudBees Jenkins Google OAuth Credentials Plugin 信息泄露漏洞 | |
| CVE-2019-10439 | CloudBees Jenkins CRX Content Package Deployer Plugin 安全漏洞 | |
| CVE-2019-10438 | CloudBees Jenkins CRX Content Package Deployer Plugin 安全漏洞 | |
| CVE-2019-10441 | CloudBees Jenkins iceScrum Plugin 跨站请求伪造漏洞 | |
| CVE-2019-10440 | CloudBees Jenkins NeoLoad Plugin 安全漏洞 | |
| CVE-2019-10443 | CloudBees Jenkins iceScrum Plugin 安全漏洞 | |
| CVE-2019-10442 | CloudBees Jenkins iceScrum Plugin 安全漏洞 | |
| CVE-2019-10446 | CloudBees Jenkins Cadence vManager Plugin 信任管理问题漏洞 | |
| CVE-2019-10445 | CloudBees Jenkins Google Kubernetes Engine Plugin 安全漏洞 | |
| CVE-2019-10456 | CloudBees Jenkins Oracle Cloud Infrastructure Compute Classic插件跨站请求伪造漏洞 | |
| CVE-2019-10447 | CloudBees Jenkins Sofy.AI Plugin 安全漏洞 | |
| CVE-2019-10449 | CloudBees Jenkins Fortify on Demand Plugin 安全漏洞 | |
| CVE-2019-10452 | CloudBees Jenkins View26 Test-Reporting插件安全漏洞 | |
| CVE-2019-10451 | CloudBees Jenkins SOASTA CloudTest Plugin 安全漏洞 | |
| CVE-2019-10450 | CloudBees Jenkins ElasticBox CI Plugin 安全漏洞 | |
| CVE-2019-10453 | CloudBees Jenkins Delphix Plugin 安全漏洞 | |
| CVE-2019-10455 | CloudBees Jenkins Rundeck Plugin 安全漏洞 | |
| CVE-2019-10454 | CloudBees Jenkins Rundeck插件跨站请求伪造漏洞 |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2019-10444
No comments yet