GHSA-v98h-rv7j-hf6j
Jenkins Google Compute Engine Plugin Missing Authorization vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:google-compute-engine | < 4.2.0 | 4.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Google Compute Engine Plugin 4.2.0 requires the appropriate Job/Configure permission to view these metadata.
References
External links from the advisory. They lead to third-party sites.