PT-2018-9288 · Jenkins · Jenkins Google Play Android Publisher Plugin+1

Christopher Orr · Published 2018-03-13 · Updated 2022-05-13 · CVE-2018-1000109

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Google Play Android Publisher Plugin versions 1.6 and earlier

Description: An improper authorization issue exists that allows an attacker to obtain credential IDs. The vulnerability is located in the GooglePlayBuildStepDescriptor.java file. As of version 1.7, the plugin requires the ExtendedRead permission (or Configure permission if ExtendedRead is not enabled) to the job in whose context credentials are being accessed to enumerate credential IDs and validate specified credentials.

Recommendations: For Jenkins Google Play Android Publisher Plugin versions 1.6 and earlier, update to version 1.7 or later to ensure that enumeration of credentials IDs and validation of specified credentials require the necessary permissions.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-1000109

GHSA-RVX4-GG8W-QW24

Affected Products

Jenkins

Jenkins Google Play Android Publisher Plugin

References · 6

• https://jenkins.io/security/advisory/2018-02-26/#SECURITY-715 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rvx4-gg8w-qw24 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000109 · Security Note
• https://github.com/jenkinsci/google-play-android-publisher-plugin · Note
• https://github.com/jenkinsci/google-play-android-publisher-plugin/commit/f81b058289caf3332ae40d599a36a3665b1fa13c · Note