PT-2019-14703 · Jenkins · Jenkins Google Compute Engine Plugin+1

Matt Sicker · Publicado 2019-11-21 · Atualizado 2023-10-25 · CVE-2019-16548

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier

Description A cross-site request forgery issue exists in the ComputeEngineCloud#doProvision function, which could be used to provision new agents. The Google Compute Engine Plugin version 4.2.0 mitigates this by requiring POST requests for the affected API endpoint.

Recommendations For Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier, consider updating to version 4.2.0 or later, which requires POST requests for the affected API endpoint, to prevent cross-site request forgery attacks. As a temporary workaround, consider restricting access to the ComputeEngineCloud#doProvision function until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-16548

GHSA-X24M-WR2F-P3VC

Produtos afetados

Jenkins

Jenkins Google Compute Engine Plugin

Referências · 6

• https://github.com/jenkinsci/google-compute-engine-plugin/commit/aaf81996741c67229982f70b3eaa83894e035025 · Nota
• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1586 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/11/21/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16548 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16548 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-x24m-wr2f-p3vc · Aviso do Fabricante