jenkinsci/dingtalk-plugin · Security
Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation
- GHSA ID
- GHSA-cp9r-g575-xc5f
- CVE ID
- CVE-2025-47888
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
- CVSS v3
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Description
Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.
CWEs
- CWE-20 · Improper Input Validation