Skip to content
VulniPulse
Sign in
High 1 vendor · 3 advisories

CVE-2022-28142: Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM

CVE-2022-28142 key facts

CISA KEV
Not listed (catalogue checked )
Highest advisory rating
High
CVSS base score
7.5 (Proxmox)
Vendor advisories
3 from Proxmox
Listed by VulniPulse
Record changed

Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2022-28142; each belongs to its advisory, not to every product listed. How records are collected and checked.

Vendor advisories for CVE-2022-28142

Proxmox

3 advisories
  • Advisory severityHigh7.5

    High [CVE-2022-28142] Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM

    CVE-2022-28142Source published Source updated

    Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.

    Related products — impact not confirmed
    • Proxmox
    Source-reported affected versions
    • 0.6.0
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityMedium6.5

    Medium [CVE-2022-28142 +1] Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with…

    CVE-2022-28144Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.

    Related products — impact not confirmed
    • Proxmox
    Source-reported affected versions
    • 0.7.0
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityMedium6.5

    Medium [CVE-2022-28142 +1] cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier

    CVE-2022-28143Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password (perform a connection test), disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see CVE-2022-28142), and test a rollback with attacker-specified parameters.

    Related products — impact not confirmed
    • Proxmox
    Source-reported affected versions
    • 0.7.0
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

References

More Proxmox advisories

All Proxmox advisories

Get an email when Proxmox publishes the next one.

See Proxmox's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Proxmox

iPhone and Android apps · New on the App Store

Monitor future Proxmox CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Download on the App StoreGet CVE alerts on AndroidSee app features