CVE-2019-16547: Jenkins Google Compute Engine Plugin Missing Authorization vulnerability
Summary
CVE-2019-16547: Jenkins Google Compute Engine Plugin Missing Authorization vulnerability. Affects org.jenkins-ci.plugins:google-compute-engine versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Google Compute Engine Plugin is a Maven package that provides integration between Jenkins and Google Compute Engine. It allows users to create and manage virtual machines on Google Cloud Platform as part of their Jenkins workflows. The plugin offers various features such as launching instances, managing instance templates, and executing commands on instances. However, versions 4.1.1 and earlier of the plugin have a vulnerability that allows attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.
Vulnerability Detail
The missing permission checks in the affected API endpoints of Jenkins Google Compute Engine Plugin 4.1.1 and earlier enable attackers with Overall/Read permission to gather restricted information about the plugin configuration and environment. This vulnerability can be exploited to gain insights into the plugin's settings and potentially gather sensitive data. However, starting from version 4.2.0, the plugin requires the appropriate Job/Configure permission to view this metadata, mitigating the vulnerability.
How To Fix
Minimum fixed version
4.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is advised to upgrade to the fixed version of the plugin as soon as possible.
Conclusion
The Jenkins Google Compute Engine Plugin versions 4.1.1 and earlier are affected by a missing authorization vulnerability that allows attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Upgrading to version 4.2.0 or later is crucial to address this vulnerability and prevent unauthorized access to sensitive data. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-compute-engine →
FAQ
The vulnerability allows attackers with Overall/Read permission to gather limited information about the plugin configuration and environment. While the impact may vary depending on the specific use case, it could potentially lead to unauthorized access to sensitive data or expose details that aid in further attacks.
No, this vulnerability requires an authenticated user with Overall/Read permission to exploit it. Remote exploitation is not possible.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
Yes, upgrading the Jenkins Google Compute Engine Plugin to version 4.2.0 or later fixes this vulnerability.
No, upgrading to the fixed version is the recommended and only known solution to mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:google-compute-engine.
