Jenkins Project Jenkins Google Compute Engine Plugin vulnerabilities

4 vulnerabilities

Known vulnerabilities in Jenkins Project Jenkins Google Compute Engine Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2022-29052jenkins projectjenkins google compute engine plugin+2
EPSS score
0.75%
Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.8.8CVE-2019-16548jenkins projectjenkins google compute engine plugin+2
EPSS score
0.69%
A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.5.9CVE-2019-16546jenkins projectjenkins google compute engine plugin+2
EPSS score
0.87%
Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.4.3CVE-2019-16547jenkins projectjenkins google compute engine plugin+2
EPSS score
0.69%
Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.