CVE-2018-1000109: Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs
Summary
CVE-2018-1000109: Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs. Affects org.jenkins-ci.plugins:google-play-android-publisher versions < 1.7. Fixed in 1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Google Play Android Publisher Plugin is a Maven package that provides functionality for automating the deployment of Android applications to the Google Play Store. It allows developers to easily publish and manage their apps on the Google Play platform. This plugin is widely used in Jenkins CI/CD pipelines for Android app development and deployment.
Vulnerability Detail
An improper authorization vulnerability exists in the Jenkins Google Play Android Publisher Plugin version 1.6 and earlier. The vulnerability is located in the GooglePlayBuildStepDescriptor.java file. It allows an attacker to obtain credential IDs, potentially leading to unauthorized access to sensitive information or actions. The vulnerability arises from a lack of proper authorization checks when accessing credentials in the plugin's context. This issue has been assigned the CVE identifier CVE-2018-1000109 and has a CVSS score of 4.3 (Moderate).
How To Fix
Minimum fixed version
1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of the plugin.
Conclusion
The Jenkins Google Play Android Publisher Plugin version 1.6 and earlier is vulnerable to an improper authorization issue that allows attackers to obtain credential IDs. Upgrading to version 1.7 or later of the plugin is recommended to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-play-android-publisher →
FAQ
This vulnerability allows an attacker to obtain credential IDs, potentially leading to unauthorized access to sensitive information or actions within the Jenkins Google Play Android Publisher Plugin.
There is no known exploit available for this vulnerability at the moment.
No, only versions 1.6 and earlier of the Jenkins Google Play Android Publisher Plugin are affected. Version 1.7 and later have fixed this vulnerability.
You can check the version of the Jenkins Google Play Android Publisher Plugin by navigating to the 'Manage Jenkins' page, selecting 'Manage Plugins', and finding the plugin in the list of installed plugins.
You can find more information about this vulnerability in the CVE entry CVE-2018-1000109 and the GitHub advisory GHSA-rvx4-gg8w-qw24.
