CVE-2019-1003099

2019-04-0416:29:02

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
openid-plugineqopenid-2.0
openid-plugineqopenid-1.0
openid-plugineqopenid-2.2
openid-plugineqopenid-1.7
openid-plugineqopenid-1.6
openid-plugineqopenid-1.8
openid-plugineqopenid-1.1
openid-plugineqopenid-1.3
openid-plugineqopenid-2.3
openid-plugineqopenid-1.2

Name	Operator	Version
openid-plugin	eq	openid-2.0
openid-plugin	eq	openid-1.0
openid-plugin	eq	openid-2.2
openid-plugin	eq	openid-1.7
openid-plugin	eq	openid-1.6
openid-plugin	eq	openid-1.8
openid-plugin	eq	openid-1.1
openid-plugin	eq	openid-1.3
openid-plugin	eq	openid-2.3
openid-plugin	eq	openid-1.2