Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.

Affected Packages

Maven io.jenkins.plugins:neuvector-vulnerability-scanner

Affected versions: 0 (last affected: 1.22)

Related CVEs

CVE-2023-30517

Key Information

GHSA ID

GHSA-r3mm-v4x7-2phm

Published

April 12, 2023 6:30 PM

Last Modified

April 12, 2023 10:19 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

io.jenkins.plugins:neuvector-vulnerability-scanner

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.