CVE-2019-1003085

2019-04-0416:29:01

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
zephyr-enterprise-test-management-plugineqzephyr-enterprise-test-management-1.2
zephyr-enterprise-test-management-plugineqzephyr-enterprise-test-management-1.1
zephyr-enterprise-test-management-plugineqzephyr-enterprise-test-management-1.4
zephyr-enterprise-test-management-plugineqzephyr-enterprise-test-management-1.5
zephyr-enterprise-test-management-plugineqzephyr-enterprise-test-management-1.6
zephyr-enterprise-test-management-plugineqzephyr-enterprise-test-management-1.0
zephyr-enterprise-test-management-plugineqzephyr-enterprise-test-management-1.3

Name	Operator	Version
zephyr-enterprise-test-management-plugin	eq	zephyr-enterprise-test-management-1.2
zephyr-enterprise-test-management-plugin	eq	zephyr-enterprise-test-management-1.1
zephyr-enterprise-test-management-plugin	eq	zephyr-enterprise-test-management-1.4
zephyr-enterprise-test-management-plugin	eq	zephyr-enterprise-test-management-1.5
zephyr-enterprise-test-management-plugin	eq	zephyr-enterprise-test-management-1.6
zephyr-enterprise-test-management-plugin	eq	zephyr-enterprise-test-management-1.0
zephyr-enterprise-test-management-plugin	eq	zephyr-enterprise-test-management-1.3