Lucene search

JenkinsCVE-2019-1003076

HistoryApr 04, 2019 - 4:29 p.m.

CVE-2019-1003076

2019-04-0416:29:01

CWE-352

jenkins

web.nvd.nist.gov

cve-2019-1003076

cross-site request forgery

jenkins

audit to database plugin

dbauditpublisherdescriptorimpl

form validation

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

58.6%

JSON

A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

Affected configurations

Nvd

Node

jenkinsaudit_to_databasejenkins

VendorProductVersionCPE
jenkinsaudit_to_database*cpe:2.3:a:jenkins:audit_to_database:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	audit_to_database	*	cpe:2.3:a:jenkins:audit_to_database::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Audit to Database Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "all versions as of 2019-04-03"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2019/04/12/2

www.securityfocus.com/bid/107790

jenkins.io/security/advisory/2019-04-03/#SECURITY-977

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

58.6%

JSON

Related for CVE-2019-1003076