Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Dec 20, 2023
Package
Affected versions
<= 1.6
Patched versions
1.7
Description
Published by the National Vulnerability Database
Mar 13, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Dec 7, 2022
Last updated
Dec 20, 2023
An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in
GooglePlayBuildStepDescriptor.javathat allow an attacker to obtain credential IDs. As of version 1.7, enumeration of credentials IDs and validation of specified credentials in this plugin requires the permissions to have the ExtendedRead permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed.References