Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-1003036 · ADVISORY
• jenkinsci/azure-vm-agents-plugin commit 6cf1e11 · WEB
• jenkinsci/azure-vm-agents-plugin · PACKAGE
• jenkins.io/security/advisory/2019-03-06 · WEB
• securityfocus.com/bid/107476 · WEB

More vulnerabilities in org.jenkins-ci.plugins:azure-vm-agents

• CVE-2023-32990MEDIUM 6.5A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to…
• CVE-2023-32989HIGH 8.8A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to conne…
• CVE-2023-32988MEDIUM 4.3A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to…
• CVE-2019-1003037MEDIUM 6.5An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagen…
• CVE-2019-1003035MEDIUM 4.3An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagen…