Riskcovery

CVE-2023-49652

State
Published
Severity
Not scored
Published
Nov 29, 2023
Updated
Aug 2, 2024
Reserved
Nov 28, 2023

Read the record on cve.org

Description

Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Jenkins Google Compute Engine PluginJenkins Project
  • 4.551.v5a_4dc98f6962 and laterNot affected
  • 4.3.17.1 to before 4.3.17.*Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.