PT-2019-14703 · Jenkins · Jenkins Google Compute Engine Plugin+1

Matt Sicker · Published 2019-11-21 · Updated 2023-10-25 · CVE-2019-16548

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier

Description A cross-site request forgery issue exists in the ComputeEngineCloud#doProvision function, which could be used to provision new agents. The Google Compute Engine Plugin version 4.2.0 mitigates this by requiring POST requests for the affected API endpoint.

Recommendations For Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier, consider updating to version 4.2.0 or later, which requires POST requests for the affected API endpoint, to prevent cross-site request forgery attacks. As a temporary workaround, consider restricting access to the ComputeEngineCloud#doProvision function until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-16548

GHSA-X24M-WR2F-P3VC

Affected Products

Jenkins

Jenkins Google Compute Engine Plugin

References · 6

• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16548 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16548 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x24m-wr2f-p3vc · Vendor Advisory
• https://github.com/jenkinsci/google-compute-engine-plugin/commit/aaf81996741c67229982f70b3eaa83894e035025 · Note
• http://openwall.com/lists/oss-security/2019/11/21/1 · Note