PT-2023-31279 · Google+1 · Google Cloud Platform+1

James Nord · Publicado 2023-11-29 · Atualizado 2023-12-05 · CVE-2023-49652

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Compute Engine Plugin versions 4.550.vb 327fca 3db 11 and earlier

Description The issue is related to incorrect permission checks in the Jenkins Google Compute Engine Plugin. Attackers with global Item/Configure permission, but lacking Item/Configure permission on any particular job, can enumerate system-scoped credentials IDs of credentials stored in Jenkins. They can also connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method to obtain information about existing projects.

Recommendations For Jenkins Google Compute Engine Plugin versions 4.550.vb 327fca 3db 11 and earlier, update to version 4.3.17.1 or later, which includes the backported fix. For version 4.551.v5a 4dc98f6962 and later, ensure that Overall/Administer permission is required for the affected HTTP endpoints.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-49652

GHSA-PGPJ-83G3-MFR2

Produtos afetados

Google Cloud Platform

Jenkins

Referências · 7

• https://t.me/cvenotify/62334 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-49652 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-49652 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pgpj-83g3-mfr2 · Aviso do Fabricante
• https://t.me/cvenotify/61477 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-11-29/#SECURITY-2835 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/11/29/1 · Nota