Jenkins Google Compute Engine Plugin Missing Authorization vulnerability

MEDIUM 4.3CVE-2019-16547 · GHSA-v98h-rv7j-hf6j · Published 21/11/2019 · updated 17/06/2026

In short

CVE-2019-16547 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:google-compute-engine, google compute engine (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.9% of all vulnerabilities.
Fix: update to 4.2.0 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:google-compute-engine Maven	`< 4.2.0`	`4.2.0`
google compute engine jenkins	`< 4.2.0`	`4.2.0`

Description

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Google Compute Engine Plugin 4.2.0 requires the appropriate Job/Configure permission to view these metadata.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-16547 · ADVISORY
jenkins.io/security/advisory/2019-11-21 · WEB
openwall.com/lists/oss-security/2019/11/21/1 · WEB

More vulnerabilities in org.jenkins-ci.plugins:google-compute-engine

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:google-compute-engine

Maven

< 4.2.0

4.2.0

google compute engine

jenkins

< 4.2.0

4.2.0

Description

NVD description

More vulnerabilities in org.jenkins-ci.plugins:google-compute-engine

See all →