CVE-2024-47806
published 2024-10-02CVE-2024-47806: Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to…
PriorityP351high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.63%
46.1th percentile
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | credentials_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | openid_connect_authentication | < 4.355.v3a_fb_fca_b_96d4 | 4.355.v3a_fb_fca_b_96d4 |
| jenkins | openid_connect_authentication_plugin | — | — |
| jenkins | plain_credentials_plugin | — | — |
| jenkins_project | jenkins_openid_connect_authentication_plugin | <= 4.354.v321ce67a_1de8 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
osv·2024-10-02
CVE-2024-47806 [CRITICAL] Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client.
This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the `aud` (Audience) claim of an ID Token during its authentication flow.
GHSA
Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
ghsa·2024-10-02
CVE-2024-47806 [CRITICAL] CWE-287 Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client.
This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the `aud` (Audience) claim of an ID Token during its authentication flow.
Jenkins
Jenkins Security Advisory 2024-10-02
vendor_jenkins·2024-10-02·CVSS 4.3
CVE-2024-47803 [MEDIUM] Jenkins Security Advisory 2024-10-02
Title: Jenkins Security Advisory 2024-10-02
Jenkins Security Advisory 2024-10-02
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Credentials
Plugin
OpenId Connect Authentication
Plugin
Descriptions
Exposure of multi-line secrets through error messages in Jenkins
SECURITY-3451
/
CVE-2024-47803
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-02
Published