-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two credential-related functions lacking authorization checks. The pre-patch versions of doFillGoogleCredentialsIdItems() and doCheckGoogleCredentialsId() did not validate ExtendedRead/Configure permissions, as shown in the commit diff adding @AncestorInPath and permission checks. These functions directly handled credential enumeration and validation, which the CVE description explicitly identifies as the attack vector. The commit message confirms these were the security-sensitive endpoints requiring protection.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:google-play-android-publisher | maven | <= 1.6 | 1.7 |
A Semantic Attack on Google Gemini - Read the Latest Research