CVE-2019-16547

CWE-862 — Missing Authorization CWE-2855 documents5 sources

Severity

4.3MEDIUM

EPSS

0.0%

top 91.14%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Google Compute Engine Jenkins Project Jenkins Google Compute Engine Plugin

Timeline

PublishedNov 21

Latest updateMay 24

Description

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶Mavenorg.jenkins-ci.plugins:google-compute-engine< 4.2.0

▶CVEListV5jenkins_project/jenkins_google_compute_engine_plugin4.1.1 and earlier

▶NVDjenkins/google_compute_engine< 4.2.0

🔴Vulnerability Details

OSV

Jenkins Google Compute Engine Plugin Missing Authorization vulnerability↗2022-05-24

▶

GHSA

Jenkins Google Compute Engine Plugin Missing Authorization vulnerability↗2022-05-24

▶

CVEList

CVE-2019-16547: Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4↗2019-11-21

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2019-11-21↗2019-11-21

▶