Jenkins Vsphere vulnerabilities

3 CVEs affecting Jenkins Vsphere, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1000153, published 2018-04-05.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-1000152, published 2018-04-05. Medium severity, CVSS 6.3. EPSS: 0.7% chance of exploitation in the next 30 days. An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java,…
• CVE-2018-1000153, published 2018-04-05. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java,…
• CVE-2018-1000151, published 2018-04-05. Medium severity, CVSS 5.6. EPSS: 0.4% chance of exploitation in the next 30 days. A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default.