CVE-2019-1003085: A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestC...

Security readout for executives and security teams

This Jenkins plugin flaw lets a low-privileged Jenkins user make the server try to connect to an attacker-chosen address. The direct business risk is unintended outbound network access from Jenkins, which can expose internal services or support reconnaissance if Jenkins can reach sensitive networks. Exposure is limited to Jenkins deployments with the Zephyr Enterprise Test Management Plugin installed and users holding Overall/Read permission. Network impact depends on what Jenkins can reach outbound or internally. Treat as a moderate Jenkins exposure issue. Prioritize if Jenkins is internet-accessible, broadly readable, or has network reach into sensitive systems. Otherwise handle through normal vulnerability management. Mitigation focus: Identify Jenkins instances with the affected Zephyr Enterprise Test Management Plugin installed.; Check Jenkins advisory and plugin vendor guidance for fixed versions or replacement guidance.; Limit Overall/Read permission to trusted users only..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.