CVE-2018-1000109

2018-03-1313:29:00

Google

osv.dev

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.3%

JSON

An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java that allow an attacker to obtain credential IDs.

CPENameOperatorVersion
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.1
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.4
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.4.1
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.3
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.5
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.3.1
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.6
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.0
google-play-android-publisher-plugineqgoogle-play-android-publisher-1.2

Name	Operator	Version
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.1
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.4
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.4.1
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.3
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.5
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.3.1
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.6
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.0
google-play-android-publisher-plugin	eq	google-play-android-publisher-1.2

References

jenkins.io/security/advisory/2018-02-26/#SECURITY-715