CVE-2019-1003035 Information disclosure in Azure VM Agents Plugin

What is CVE-2019-1003035?

CVE-2019-1003035 is a medium-severity vulnerability in Jenkins Azure VM Agents Plugin, published on 8 Mar 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTemplate.java, src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to perform the 'verify configuration' form validation action, thereby obtaining limited information about the Azure configuration.

Weakness: CWE-862

Which versions are affected by CVE-2019-1003035?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:azure-vm-agents. It affects 1 product.

Products include Jenkins Azure Vm Agents.

How do I fix CVE-2019-1003035?

Upgrade org.jenkins-ci.plugins:azure-vm-agents to 0.8.1 or later.

Is CVE-2019-1003035 being exploited?

There is no known exploitation of CVE-2019-1003035 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Azure VM Agents Plugin

• CVE-2023-32989 Jenkins Azure VM Agents Plugin Cross-site Request Forgery vulnerability High 8.8
• CVE-2023-32990 Jenkins Azure VM Agents Plugin missing permission checks Medium 6.5
• CVE-2019-1003037 Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin Medium 6.5
• CVE-2023-32988 Jenkins Azure VM Agents Plugin missing permission checks Medium 4.3
• CVE-2019-1003036 Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hg6-c7f8-3348.