Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-1003037 · ADVISORY
• jenkinsci/azure-vm-agents-plugin commit e36c8a9 · WEB
• jenkinsci/azure-vm-agents-plugin · WEB
• jenkins.io/security/advisory/2019-03-06 · WEB
• securityfocus.com/bid/107476 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:azure-vm-agents

• CVE-2023-32990MITTEL 6.5A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to…
• CVE-2023-32989HOCH 8.8A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to conne…
• CVE-2023-32988MITTEL 4.3A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to…
• CVE-2019-1003036MITTEL 4.3A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/Az…
• CVE-2019-1003035MITTEL 4.3An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagen…