CVE-2021-22511
SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
- Record
CVE-2021-22511- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
- Record
CVE-2021-22511- Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2022-4859 No score
Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow unconditionally disabling of SSL/TLS certificates.
- Record
EUVD-2022-4859- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q296-9j5x-fxf4
SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers.
Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by default. It provides an option to disable SSL/TLS certification validation for connections to Service Virtualization servers.
- Record
GHSA-q296-9j5x-fxf4- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-q296-9j5x-fxf4
SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers.
Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by default. It provides an option to disable SSL/TLS certification validation for connections to Service Virtualization servers.
- Record
GHSA-q296-9j5x-fxf4- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:hp-application-automation-tools-pluginMaven |
through 6.7 | 6.8 |
org.jenkins-ci.plugins:hp-application-automation-tools-pluginMaven |
before 6.8, plus listed versions 1.01.0.22.0.02.0.23.0.5 Show 45 moreShow less3.0.63.0.74.04.0.14.5.05.05.0.0-beta-15.15.1-beta-15.1.0.1-beta5.1.0.2-beta5.25.2.0.1-beta5.35.3.1-beta5.3.2-beta5.3.3-beta5.3.4-beta5.45.4.1-beta5.4.2-beta5.55.5.1-beta5.5.2-beta5.5.3-beta5.5.4-beta5.65.6.15.6.25.6.3-beta5.6.4-beta5.6.5-beta5.75.7.1-beta5.7.2-beta5.7.3-beta5.7.4-beta5.85.8.1-beta5.8.2-beta5.8.3-beta5.8.4-beta5.8.5-beta5.8.6-beta5.8.7-beta |
6.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22511 is a medium vulnerability (CVSS 6.5) in Microfocus Application Automation Tools, published April 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in org.jenkins-ci.plugins:hp-application-automation-tools-plugin 6.8.
References
Left out here: 43 versions. The JSON record has them.