Read the docs
TI-2023-27111 Aliases CVE-2023-49652GHSA-pgpj-83g3-mfr2

Missing authorization in Jenkins Google Compute Engine Plugin

Priority LOW 14CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.

Why it matters now

EPSS 0.00531 45th percentileScored 2026-11-07
Fix Fixed Jenkins Google Compute Engine Plugin (Jenkins Project): 4.551.v5a_4dc98f6962, 4.3.17.1org.jenkins-ci.plugins:google-compute-engine (Maven): 4.3.17.1, 4.551.v5a

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Google Compute Engine Plugin—4.551.v5a_4dc98f6962, 4.3.17.1Patch availableCNA
—org.jenkins-ci.plugins:google-compute-engine (Maven)before 4.3.17.14.3.17.1Patch availableGHSA-pgpj-83g3-mfr2
—org.jenkins-ci.plugins:google-compute-engine (Maven)4.5 to before 4.551.v5a4.551.v5aPatch availableGHSA-pgpj-83g3-mfr2
  • Jenkins Google Compute Engine Plugin VendorJenkins Affected — Fixed in 4.551.v5a_4dc98f6962, 4.3.17.1 Patch available CNA
  • org.jenkins-ci.plugins:google-compute-engine (Maven) Vendor— Affected before 4.3.17.1 Fixed in 4.3.17.1 Patch available GHSA-pgpj-83g3-mfr2
  • org.jenkins-ci.plugins:google-compute-engine (Maven) Vendor— Affected 4.5 to before 4.551.v5a Fixed in 4.551.v5a Patch available GHSA-pgpj-83g3-mfr2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:google_compute_engine:*:*:*:*:*:jenkins:*:*before 4.3.17.1VulnerableJenkins
  • cpe:2.3:a:jenkins:google_compute_engine:*:*:*:*:*:jenkins:*:* Versions before 4.3.17.1 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins Google Compute Engine Plugin (Jenkins Project) Fixed in 4.551.v5a_4dc98f6962, 4.3.17.1
  • Fix · GHSA-pgpj-83g3-mfr2 org.jenkins-ci.plugins:google-compute-engine (Maven) Fixed in 4.3.17.1 Advisory →
  • Fix · GHSA-pgpj-83g3-mfr2 org.jenkins-ci.plugins:google-compute-engine (Maven) Fixed in 4.551.v5a Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49652
  2. 2026-10-03 Alias added: GHSA-pgpj-83g3-mfr2

References

Advisory 3

  • TI-2023-27120 Cross-site request forgery in Jenkins NeuVector Vulnerability Scanner Plugin CVSS 3.1HIGH 8.8
  • TI-2019-12410 Cross-site request forgery in Jenkins Google Compute Engine Plugin CVSS 3.1HIGH 8.8
  • TI-2019-12408 Authorization bypass in Jenkins Google Compute Engine Plugin CVSS 3.1MEDIUM 5.9
  • TI-2022-11618 Insufficiently protected credentials in Jenkins Google Compute Engine Plugin CVSS 3.1MEDIUM 4.3
  • TI-2019-12409 Missing authorization in Jenkins Google Compute Engine Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences