GCVE - cpe:2.3:a:jenkins_project:jenkins_google_compute_engine

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins_project:jenkins_google_compute_engine_plugin:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Jenkins Project (`860cd631-1316-551d-89a3-5aa9a0d4f462`)
Product	Jenkins Google Compute Engine Plugin (`760cb70c-e593-5a5c-8179-0df56aa9604d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-49652`	not_vulnerable	2026-06-08 06:14:29.286387	Details available Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs of credentials stored in Jenkins and to connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method, to obtain information about existing projects. This fix has been backported to 4.3.17.1. Published: 2023-11-29T13:45:09.576Z Updated: 2024-08-02T22:01:25.605Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-2835 http://www.openwall.com/lists/oss-security/2023/11/29/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29052`	vulnerable	2026-06-08 05:42:46.373483	Details available Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Published: 2022-04-12T19:50:54.000Z Updated: 2024-10-15T17:13:31.123Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2045	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16548`	vulnerable	2026-06-08 05:13:08.560046	Details available A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents. Published: 2019-11-21T14:11:24.000Z Updated: 2024-08-05T01:17:40.791Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1586 http://www.openwall.com/lists/oss-security/2019/11/21/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16547`	vulnerable	2026-06-08 05:13:08.559594	Details available Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Published: 2019-11-21T14:11:23.000Z Updated: 2024-08-05T01:17:40.265Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585 http://www.openwall.com/lists/oss-security/2019/11/21/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16546`	vulnerable	2026-06-08 05:13:08.558661	Details available Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Published: 2019-11-21T14:11:23.000Z Updated: 2024-08-05T01:17:40.240Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584 http://www.openwall.com/lists/oss-security/2019/11/21/1	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Jenkins Google Compute Engine Plugin

PURL mappings

Vulnerability references

Contribute