CVE-2019-1003036: Missing Authorization

May 13, 2022 (updated December 14, 2023)

A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent.

References

www.securityfocus.com/bid/107476
github.com/advisories/GHSA-m33c-cjjj-2mg4
github.com/jenkinsci/azure-vm-agents-plugin/commit/6cf1e11778993988ded08eb15ea051541341ec12
jenkins.io/security/advisory/2019-03-06/
nvd.nist.gov/vuln/detail/CVE-2019-1003036

Code Behaviors & Features

Detect and mitigate CVE-2019-1003036 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →