Jenkins instance traffic sent over an unencrypted channel

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_48
Category	System Configuration
Severity	MEDIUM

Impact

Traffic of the Jenkins instance is sent over an unencrypted layer. An attacker can perform a Man In The Middle attack to collect sensitive information, such as credentials or application code, or to modify the data sent to/from the instance to perform malicious actions.

Recommended Solution - Buildtime

Encrypt all data in transit, flowing to and from the Jenkins instance. Follow best practices when implementing the HTTPS protocol: https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html