CVE-2019-1003077: Medium severity jenkins audit to database vulnerability
Published Apr 4, 2019
·Updated
A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected Software
2 affected components
Jenkins Audit To Database Jenkins
maven/org.jenkins-ci.plugins:audit2db<=0.5
Event History
Apr 4, 2019
CVE Published
via MITRE·03:38 PM
Data Sourced
via MITRE·03:38 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:17 AM
Frequently Asked Questions
1
What is the severity of CVE-2019-1003077?
The severity of CVE-2019-1003077 is classified as medium.
2
How do I fix CVE-2019-1003077?
To fix CVE-2019-1003077, update the Jenkins Audit to Database Plugin to version 0.5 or later.
3
Who is affected by CVE-2019-1003077?
Any Jenkins instance using the Audit to Database Plugin version 0.5 or earlier is affected by CVE-2019-1003077.
4
What types of attacks can CVE-2019-1003077 enable?
CVE-2019-1003077 can allow attackers with Overall/Read permission to initiate unauthorized database connections.
5
Does CVE-2019-1003077 require authentication to exploit?
Yes, CVE-2019-1003077 requires the attacker to have Overall/Read permission to exploit the vulnerability.