CVE-2023-49652
First published: Wed Nov 29 2023(Updated: )
Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Google Compute Engine | <4.3.17.1 | |
| maven/org.jenkins-ci.plugins:google-compute-engine | >=4.5<4.551.v5a | 4.551.v5a |
| maven/org.jenkins-ci.plugins:google-compute-engine | <4.3.17.1 | 4.3.17.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-49652?
CVE-2023-49652 is a vulnerability in Jenkins Google Compute Engine Plugin that allows attackers with global Item/Configure permission to perform unauthorized actions.
What is the severity of CVE-2023-49652?
CVE-2023-49652 has a severity of medium with a CVSS score of 4.3.
How does CVE-2023-49652 affect Jenkins Google Compute Engine Plugin?
CVE-2023-49652 affects Jenkins Google Compute Engine Plugin version 4.550.vb_327fca_3db_11 and earlier.
How can an attacker exploit CVE-2023-49652?
An attacker with global Item/Configure permission can exploit CVE-2023-49652 to perform unauthorized actions on Jenkins Google Compute Engine Plugin.
How do I fix CVE-2023-49652?
To fix CVE-2023-49652, upgrade to version 4.551.v5a or later of Jenkins Google Compute Engine Plugin.
- collector/mitre-cve
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-pgpj-83g3-mfr2
- alias/CVE-2023-49652
- collector/nvd-cve
- collector/github-advisory
- vendor/jenkins
- canonical/jenkins google compute engine
- package-manager/maven