CVE-2023-49652: 
Java vulnerability analysis and mitigation

The vulnerability CVE-2023-49652 affects the Jenkins Google Compute Engine Plugin versions 4.550.vb327fca3db_11 and earlier. The vulnerability was discovered and reported by James Nord from CloudBees, Inc., and was publicly disclosed on November 29, 2023. This security issue involves incorrect permission checks in multiple HTTP endpoints of the plugin (Jenkins Advisory).

The vulnerability is classified as Medium severity with a CVSS v3.1 base score of 2.7 (LOW) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. The issue stems from improper permission checks in multiple HTTP endpoints, which is categorized as CWE-862 (Missing Authorization) (NVD).

The vulnerability allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate system-scoped credentials IDs stored in Jenkins and connect to Google Cloud Platform using attacker-specified credentials IDs obtained through another method. This access enables attackers to obtain information about existing projects (Jenkins Advisory).

The vulnerability has been fixed in Google Compute Engine Plugin version 4.551.v5a_4dc98f6962, which now requires Overall/Administer permission for the affected HTTP endpoints. The fix has also been backported to version 4.3.17.1. Users are advised to upgrade to the fixed version (Jenkins Advisory).