Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs

中 4.3CVE-2018-1000109 · GHSA-rvx4-gg8w-qw24 · 13/03/2018 公開 · 17/06/2026 更新

要点

CVE-2018-1000109 は org.jenkins-ci.plugins:google-play-android-publisher, google-play-android-publisher (jenkins) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.66%（全脆弱性の 51.9% より高い）。
対処：1.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:google-play-android-publisher Maven	`< 1.7`	`1.7`
google-play-android-publisher jenkins	`≤ 1.6`	修正版なし

概要

An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java that allow an attacker to obtain credential IDs. As of version 1.7, enumeration of credentials IDs and validation of specified credentials in this plugin requires the permissions to have the ExtendedRead permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed.

NVD の説明

An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java that allow an attacker to obtain credential IDs.