CVE-2019-1003087: Medium severity sinatra vulnerability
Published Apr 4, 2019
·Updated
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected Software
2 affected components
maven/org.jenkins-ci.plugins:sinatra-chef-builder<=1.20
Jenkins Chef Sinatra Jenkins<=1.2
Event History
Apr 4, 2019
CVE Published
via MITRE·03:38 PM
Data Sourced
via MITRE·03:38 PM
Description
May 13, 2022
Advisory Published
via GitHub·01:25 AM
Frequently Asked Questions
1
What is the severity of CVE-2019-1003087?
CVE-2019-1003087 has a high severity due to the potential for unauthorized server connections.
2
How do I fix CVE-2019-1003087?
To fix CVE-2019-1003087, upgrade the Jenkins Chef Sinatra Plugin to version 1.3 or later.
3
What version of Jenkins is affected by CVE-2019-1003087?
CVE-2019-1003087 affects Jenkins Chef Sinatra Plugin versions up to and including 1.2.
4
Can any user trigger the vulnerability in CVE-2019-1003087?
Yes, any user with Overall/Read permission can exploit the vulnerability in CVE-2019-1003087.
5
What functionality is compromised due to CVE-2019-1003087?
CVE-2019-1003087 compromises the ability to validate connections to potentially malicious servers.