CVE-2019-16547 - Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment

Back Back to CVE browser

MEDIUM

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment

Published Nov 21, 2019

4.3

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.

Affected products

Vendor Jenkins project Product Jenkins Google Compute Engine Plugin Default
n/a
- Version
  4.1.1 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Google Compute Engine Plugin

n/a

Version	Status	Constraints
4.1.1 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-285

CWE-862

Missing Authorization

References (5)

http://www.openwall.com/lists/oss-security/2019/11/21/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5324
Advisory
https://github.com/advisories/GHSA-v98h-rv7j-hf6j
Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16547

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/11/21/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5324		Advisory
https://github.com/advisories/GHSA-v98h-rv7j-hf6j		Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16547