{"id":"CVE-2023-49652","aliases":["EUVD-2023-3006","GHSA-pgpj-83g3-mfr2"],"status":"published","title":"Jenkins Google Compute Engine Plugin has incorrect permission checks","description":"Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00531,"percentile":0.45118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2023-11-29T13:45:09Z","modified":"2026-10-24T10:30:37Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:google-compute-engine","fixed_in":["4.3.17.1","4.551.v5a"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:google-compute-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:google-compute-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.551.v5a"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:google-compute-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17.1"}]}],"versions":["1.0-beta-1","1.0-beta-2","1.0.0","1.0.1","1.0.10","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","2.0.0","3.0.0","3.1.0","3.1.1","3.2.0","3.3.0","3.3.1","3.3.2","3.4.0","4.0.0","4.1.0","4.1.1","4.2.0","4.3.0","4.3.1","4.3.11","4.3.12","4.3.13","4.3.14","4.3.15","4.3.16","4.3.17","4.3.2","4.3.3","4.3.4","4.3.5","4.3.7","4.3.8","4.3.9"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:google-compute-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5"},{"fixed":"4.551.v5a"}]}],"versions":["4.548.v4a_7f1b_1767b_1","4.550.vb_327fca_3db_11"]}],"products":[{"vendor":"jenkins","product":"google_compute_engine"},{"vendor":"jenkins project","product":"jenkins google compute engine plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-2835","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/29/1","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49652","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pgpj-83g3-mfr2"}],"sources":{"cve":[{"id":"CVE-2023-49652","description":"Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.","status":"published","published":"2023-11-29T13:45:09.576Z","modified":"2024-08-02T22:01:25.605Z","updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-3006","description":"Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.","status":"published","published":"2023-11-29T13:45:09Z","modified":"2024-08-02T22:01:25Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"none"}],"updated_at":"2026-11-03T03:49:55.731961Z"}],"ghsa":[{"id":"GHSA-pgpj-83g3-mfr2","title":"Jenkins Google Compute Engine Plugin has incorrect permission checks","description":"Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier does not correctly perform permission checks in multiple HTTP endpoints. This allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to do the following:\n\n- Enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\n- Connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects.\n\nGoogle Compute Engine Plugin 4.551.v5a_4dc98f6962 requires Overall/Administer permission for the affected HTTP endpoints.","status":"published","published":"2023-11-29T15:30:21Z","modified":"2023-12-05T22:58:59Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2023-49652","description":"Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.","status":"published","published":"2023-11-29T14:15:07.46Z","modified":"2026-06-17T06:36:16.46Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"CVE-2023-49652","description":"Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1.","status":"published","published":"2023-11-29T14:15:07.46Z","modified":"2026-10-24T10:30:37.80801672Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"GHSA-pgpj-83g3-mfr2","title":"Jenkins Google Compute Engine Plugin has incorrect permission checks","description":"Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier does not correctly perform permission checks in multiple HTTP endpoints. This allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to do the following:\n\n- Enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.\n\n- Connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects.\n\nGoogle Compute Engine Plugin 4.551.v5a_4dc98f6962 requires Overall/Administer permission for the affected HTTP endpoints.","status":"published","published":"2023-11-29T15:30:21Z","modified":"2024-02-16T08:17:27.23899Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}