CVE-2019-1003091

EUVD-2022-3786 · Published May 13, 2022

Missing permission check in Jenkins SOASTA CloudTest Plugin A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

Technologies

Jenkins Soasta Cloudtest

Weaknesses

CWE-862

CVSS scores

v3.16.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Stealth Defense Impairment Credential Access

T1190Exploit Public-Facing Application T1211Exploitation for Stealth T1542.002Component Firmware T1556Modify Authentication Process

References

http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1054
https://nvd.nist.gov/vuln/detail/CVE-2019-1003091

Potentially impacted assets

See if this affects your attack surface