Lucene search

JenkinsCVE-2019-1003017

HistoryFeb 06, 2019 - 4:29 p.m.

CVE-2019-1003017

2019-02-0616:29:00

CWE-352

jenkins

web.nvd.nist.gov

cve-2019-1003017

jenkins

job import plugin

data modification vulnerability

security issue

nvd

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job’s configuration.

Affected configurations

Nvd

Node

jenkinsjob_importRange≤3.0jenkins

VendorProductVersionCPE
jenkinsjob_import*cpe:2.3:a:jenkins:job_import:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	job_import	*	cpe:2.3:a:jenkins:job_import::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Job Import Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "3.0 and earlier"
      }
    ]
  }
]

References

jenkins.io/security/advisory/2019-01-28/#SECURITY-1302

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

Related for CVE-2019-1003017