Lucene search

JenkinsCVE-2019-1003090

HistoryApr 04, 2019 - 4:29 p.m.

CVE-2019-1003090

2019-04-0416:29:01

CWE-352

jenkins

web.nvd.nist.gov

cve-2019-1003090

jenkins

soasta cloudtest plugin

cloudtestserver

form validation

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

58.6%

JSON

A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.

Affected configurations

Nvd

Node

jenkinssoasta_cloudtestjenkins

VendorProductVersionCPE
jenkinssoasta_cloudtest*cpe:2.3:a:jenkins:soasta_cloudtest:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	soasta_cloudtest	*	cpe:2.3:a:jenkins:soasta_cloudtest::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins SOASTA CloudTest Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "all versions as of 2019-04-03"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2019/04/12/2

www.securityfocus.com/bid/107790

jenkins.io/security/advisory/2019-04-03/#SECURITY-1054

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

58.6%

JSON

Related for CVE-2019-1003090