VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 8, 2019· Updated Aug 5, 2024

CVE-2019-1003036

CVE-2019-1003036

Description

A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:azure-vm-agentsMaven
< 0.8.10.8.1

Affected products

1

Patches

1
6cf1e1177899

[SECURITY-1331]

https://github.com/jenkinsci/azure-vm-agents-pluginJie ShenMar 4, 2019via ghsa
commit
1 file changed · +4 −0
  • src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java+4 −0 modified
    @@ -21,6 +21,7 @@
 import com.microsoft.azure.vmagent.util.CleanUpAction;
 import com.microsoft.azure.vmagent.util.Constants;
 import hudson.Extension;
+import hudson.model.Computer;
 import hudson.model.Descriptor.FormException;
 import hudson.model.TaskListener;
 import hudson.slaves.AbstractCloudComputer;
@@ -39,6 +40,7 @@
 import org.jvnet.localizer.Localizable;
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import javax.annotation.CheckForNull;
 import javax.annotation.Nullable;
@@ -594,7 +596,9 @@ public boolean isInstantiable() {
         }
 
         //abusing a bit of f:validateButton because it has nice progress
+        @RequirePOST
         public FormValidation doAttachPublicIP(@QueryParameter String vmAgentName) {
+            Jenkins.getInstance().checkPermission(Computer.CONFIGURE);
             AzureVMAgent vmAgent = (AzureVMAgent) Jenkins.getInstance().getNode(vmAgentName);
             String publicIP = "";
             if (vmAgent != null) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.