CVE-2019-16547 Jenkins Google Compute Engine Plugin Missing Authorization vulnerability

What is CVE-2019-16547?

CVE-2019-16547 is a medium-severity missing authorization vulnerability in Jenkins Google Compute Engine Plugin, published on 21 Nov 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.

Weakness: CWE-862

Which versions are affected by CVE-2019-16547?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:google-compute-engine. It affects 1 product.

Products include Jenkins Google Compute Engine.

How do I fix CVE-2019-16547?

Upgrade org.jenkins-ci.plugins:google-compute-engine to 4.2.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-16547 being exploited?

There is no known exploitation of CVE-2019-16547 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Google Compute Engine Plugin

• CVE-2023-49673 Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability High 8.8
• CVE-2019-16548 Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability High 8.8
• CVE-2019-16546 Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin Medium 5.9
• CVE-2022-29052 Private key stored in plain text by Jenkins Google Compute Engine Plugin Medium 4.3
• CVE-2023-49652 Jenkins Google Compute Engine Plugin has incorrect permission checks Low 2.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v98h-rv7j-hf6j.