CVE-2023-49652

2023-11-2914:15:07

CWE-862

[email protected]

web.nvd.nist.gov

cve-2023-49652

jenkins

google compute engine plugin

security

permission checks

nvd

vulnerability

google cloud platform

credentials

backport

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

3.4 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.5%

JSON

Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.

Affected configurations

NVD

Node

jenkinsgoogle_compute_engineRange<4.3.17.1jenkins

CPENameOperatorVersion
jenkins:google_compute_enginejenkins google compute enginelt4.3.17.1

CPE	Name	Operator	Version
jenkins:google_compute_engine	jenkins google compute engine	lt	4.3.17.1

CNA Affected

[
  {
    "vendor": "Jenkins Project",
    "product": "Jenkins Google Compute Engine Plugin",
    "versions": [
      {
        "version": "4.551.v5a_4dc98f6962",
        "versionType": "maven",
        "lessThan": "*",
        "status": "unaffected"
      },
      {
        "version": "4.3.17.1",
        "versionType": "maven",
        "lessThan": "4.3.17.*",
        "status": "unaffected"
      }
    ],
    "defaultStatus": "affected"
  }
]