CVE-2019-1003037: Missing Authorization

May 13, 2022 (updated December 14, 2023)

An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

References

www.securityfocus.com/bid/107476
github.com/advisories/GHSA-r2vw-x3hr-969v
github.com/jenkinsci/azure-vm-agents-plugin/commit/e36c8a9b0a436d3b79dc14b5cb4f7f6032fedd3f
jenkins.io/security/advisory/2019-03-06/
nvd.nist.gov/vuln/detail/CVE-2019-1003037

Code Behaviors & Features

Detect and mitigate CVE-2019-1003037 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →