Information Exposure Affecting org.jenkins-ci.plugins:azure-vm-agents package, versions [,0.8.1)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-450004
- published 17 Jun 2019
- disclosed 6 Mar 2019
- credit Oleg Nenashev, CloudBees, Inc.
Introduced: 6 Mar 2019
CVE-2019-1003035 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.plugins:azure-vm-agents
to version 0.8.1 or higher.
Overview
org.jenkins-ci.plugins:azure-vm-agents is a jenkins plugin that provisions agents on Azure cloud.
Affected versions of this package are vulnerable to Information Exposure. An information exposure vulnerability exists in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTemplate.java
and src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java
that allows attackers with Overall/Read permission to perform the verify configuration
form validation action, thereby obtaining limited information about the Azure configuration.