Description
Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/11/21/1
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585
Related Vulnerabilities
CVE-2021-31403 Vulnerability in maven package com.vaadin:vaadin-server
CVE-2019-1010266 Vulnerability in maven package org.webjars.bower:lodash
CVE-2022-28355 Vulnerability in maven package org.scala-js:scalajs-library_2.13
CVE-2022-38749 Vulnerability in maven package org.yaml:snakeyaml
CVE-2022-37223 Vulnerability in maven package com.jflyfox:jflyfox_jfinal