CVE-2019-1003091: A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValid...

Security readout for executives and security teams

This Jenkins plugin flaw lets any user with Overall/Read permission make Jenkins try to connect to a server they choose. That can expose Jenkins as an internal network probe or callback source. The sources do not provide a CVSS score, named patch, or evidence of active exploitation. Exposure applies to Jenkins environments that have the SOASTA CloudTest Plugin installed and grant Overall/Read to untrusted or broad user groups. Risk increases where Jenkins can reach sensitive internal networks or outbound internet destinations. Treat this as a targeted Jenkins hardening item, especially if Jenkins is internet-reachable or widely accessible internally. No active exploitation is cited, but Jenkins often has privileged network access, making exposure review worthwhile. Mitigation focus: Check the Jenkins advisory and plugin status for vendor-provided remediation guidance.; Inventory Jenkins controllers for the SOASTA CloudTest Plugin.; Restrict Overall/Read permission to trusted users only..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.