PT-2023-31279 · Google+1 · Google Cloud Platform+1

James Nord · Published 2023-11-29 · Updated 2023-12-05 · CVE-2023-49652

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Compute Engine Plugin versions 4.550.vb 327fca 3db 11 and earlier

Description The issue is related to incorrect permission checks in the Jenkins Google Compute Engine Plugin. Attackers with global Item/Configure permission, but lacking Item/Configure permission on any particular job, can enumerate system-scoped credentials IDs of credentials stored in Jenkins. They can also connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method to obtain information about existing projects.

Recommendations For Jenkins Google Compute Engine Plugin versions 4.550.vb 327fca 3db 11 and earlier, update to version 4.3.17.1 or later, which includes the backported fix. For version 4.551.v5a 4dc98f6962 and later, ensure that Overall/Administer permission is required for the affected HTTP endpoints.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-49652

GHSA-PGPJ-83G3-MFR2

Affected Products

Google Cloud Platform

Jenkins

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-49652 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49652 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pgpj-83g3-mfr2 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-11-29/#SECURITY-2835 · Vendor Advisory
• https://t.me/cvenotify/62334 · Telegram Post
• https://t.me/cvenotify/61477 · Telegram Post
• http://openwall.com/lists/oss-security/2023/11/29/1 · Note