PT-2019-14702 · Jenkins · Jenkins Google Compute Engine Plugin+1

Matt Sicker · Published 2019-11-21 · Updated 2023-10-25 · CVE-2019-16547

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier

Description The issue is related to missing permission checks in various API endpoints, allowing attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. This could potentially be exploited by attackers to gain insights into the system's setup.

Recommendations For Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier, update to version 4.2.0 or later, which requires the appropriate Job/Configure permission to view metadata, thereby addressing the missing permission checks issue.

Fix

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-862

CWE-285

Related Identifiers

CVE-2019-16547

GHSA-V98H-RV7J-HF6J

Affected Products

Jenkins

Jenkins Google Compute Engine Plugin

References · 5

• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v98h-rv7j-hf6j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16547 · Security Note
• http://openwall.com/lists/oss-security/2019/11/21/1 · Note