Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Jenkins Google Compute Engine Plugin: Unauthorized Cloud Agent Provisions

CVE-2019-16548 · published 6 years ago
Summary

The Jenkins Google Compute Engine Plugin, used to manage cloud-based Jenkins agents, contains a security flaw. This means an attacker could potentially trick users into creating new Jenkins agents without their consent. Update the plugin to version 4.1.2 or later to protect against this risk.

What to do
  • Update jenkins-ci org.jenkins-ci.plugins:google-compute-engine to version 4.2.0.
  • Update jenkins google_compute_engine to version 4.2.0 or later.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:google-compute-engine <= 4.1.1
Fix: upgrade to 4.2.0
– jenkins google_compute_engine < 4.2.0
cpe:2.3:a:jenkins:google_compute_engine:*:*:*:*:*:jenkins:*:*
Original advisory text
A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.
A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published21 Nov 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-x24m-wr2f-p3vc · GHSA
CVE-2019-16548 · NVD
Track software like this
Free during beta