GitHub Advisoryadvisory · Maven

GHSA-rvx4-gg8w-qw24 Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs

MEDIUM Published 2022-05-13 Modified 2022-12-07 Official page ↗
Aliases
CVE-2018-1000109
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:google-play-android-publisher
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2022-12-07

Affected packages

• Maven org.jenkins-ci.plugins:google-play-android-publisher: < 1.7 → fixed in 1.7

Description

An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in `GooglePlayBuildStepDescriptor.java` that allow an attacker to obtain credential IDs. As of version 1.7, enumeration of credentials IDs and validation of specified credentials in this plugin requires the permissions to have the ExtendedRead permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed.

Related

Alias · CVE (1)

  • CVE-2018-1000109 An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References