Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability

HIGH 8.8CVE-2019-16548 · GHSA-x24m-wr2f-p3vc · Published 21/11/2019 · updated 17/06/2026

In short

CVE-2019-16548 is a HIGH (CVSS 8.8) vulnerability affecting org.jenkins-ci.plugins:google-compute-engine, google compute engine (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.86%, higher than 58.5% of all vulnerabilities.
Fix: update to 4.2.0 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:google-compute-engine Maven	`< 4.2.0`	`4.2.0`
google compute engine jenkins	`< 4.2.0`	`4.2.0`

Description

A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents. Google Compute Engine Plugin 4.2.0 requires POST requests for this API endpoint.

NVD description

A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.

References

nvd.nist.gov/vuln/detail/CVE-2019-16548 · ADVISORY
jenkinsci/google-compute-engine-plugin commit aaf8199 · WEB
jenkins.io/security/advisory/2019-11-21 · WEB
openwall.com/lists/oss-security/2019/11/21/1 · WEB

More vulnerabilities in org.jenkins-ci.plugins:google-compute-engine

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:google-compute-engine

Maven

< 4.2.0

4.2.0

google compute engine

jenkins

< 4.2.0

4.2.0

Description

NVD description

A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.

More vulnerabilities in org.jenkins-ci.plugins:google-compute-engine

See all →