PT-2018-9288 · Jenkins · Jenkins Google Play Android Publisher Plugin+1

Christopher Orr · Publicado 2018-03-13 · Atualizado 2022-05-13 · CVE-2018-1000109

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Google Play Android Publisher Plugin versions 1.6 and earlier

Description: An improper authorization issue exists that allows an attacker to obtain credential IDs. The vulnerability is located in the GooglePlayBuildStepDescriptor.java file. As of version 1.7, the plugin requires the ExtendedRead permission (or Configure permission if ExtendedRead is not enabled) to the job in whose context credentials are being accessed to enumerate credential IDs and validate specified credentials.

Recommendations: For Jenkins Google Play Android Publisher Plugin versions 1.6 and earlier, update to version 1.7 or later to ensure that enumeration of credentials IDs and validation of specified credentials require the necessary permissions.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-1000109

GHSA-RVX4-GG8W-QW24

Produtos afetados

Jenkins

Jenkins Google Play Android Publisher Plugin

Referências · 6

• https://github.com/jenkinsci/google-play-android-publisher-plugin · Nota
• https://github.com/jenkinsci/google-play-android-publisher-plugin/commit/f81b058289caf3332ae40d599a36a3665b1fa13c · Nota
• https://jenkins.io/security/advisory/2018-02-26/#SECURITY-715 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rvx4-gg8w-qw24 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000109 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000109 · Nota de Segurança