CVE-2018-1000149
low-risk
Published 2018-04-05
A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default.
Do I need to act?
-
0.07% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.6/10
Medium
NETWORK
/ HIGH complexity
Affected Products (1)
Ansible
Affected Vendors
References (2)
Vendor Advisory
https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630
Vendor Advisory
https://jenkins.io/security/advisory/2018-03-26/#SECURITY-630
23
/ 100
low-risk
Severity
18/34 · Moderate
Exploitability
0/34 · Minimal
Exposure
5/34 · Minimal