PT-2019-14702 · Jenkins · Jenkins Google Compute Engine Plugin+1

Matt Sicker · Publicado 2019-11-21 · Atualizado 2023-10-25 · CVE-2019-16547

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier

Description The issue is related to missing permission checks in various API endpoints, allowing attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. This could potentially be exploited by attackers to gain insights into the system's setup.

Recommendations For Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier, update to version 4.2.0 or later, which requires the appropriate Job/Configure permission to view metadata, thereby addressing the missing permission checks issue.

Correção

Missing Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-862

CWE-285

Identificadores relacionados

CVE-2019-16547

GHSA-V98H-RV7J-HF6J

Produtos afetados

Jenkins

Jenkins Google Compute Engine Plugin

Referências · 5

• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-v98h-rv7j-hf6j · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-16547 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/11/21/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16547 · Nota de Segurança