Cortex CloudApplication Security
Certificate not verified by Azure Pipelines pipeline command
Rule Details
Cortex AppSec Rule ID
APPSEC_CICD_194
Category
Data Protection
Severity
MEDIUM
Impact
Not verifying certificates through pipeline commands allows attackers to plant their own certificate and impersonate a server in order to perform a man-in-the-middle attack to intercept, tamper with and/or steal information, to possibly run code in the build system and to reach the production environment.
PreviousForking of a private Azure repository is allowed
NextAzure Pipelines commands transmit data over an unencrypted channel
Last updated
Was this helpful?