CVE-2024-47807
published 2024-10-02CVE-2024-47807: Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to…
PriorityP351high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.63%
46.1th percentile
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | credentials_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | openid_connect_authentication | < 4.355.v3a_fb_fca_b_96d4 | 4.355.v3a_fb_fca_b_96d4 |
| jenkins | openid_connect_authentication_plugin | — | — |
| jenkins | plain_credentials_plugin | — | — |
| jenkins_project | jenkins_openid_connect_authentication_plugin | <= 4.354.v321ce67a_1de8 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
ghsa·2024-10-02
CVE-2024-47807 [CRITICAL] CWE-287 Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token during its authentication flow, a value that identifies the Originating Party (IdP).
This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the `iss` (Issuer) claim of an ID Token during its authentication flow when the Issuer is known.
OSV
Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
osv·2024-10-02
CVE-2024-47807 [CRITICAL] Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token during its authentication flow, a value that identifies the Originating Party (IdP).
This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the `iss` (Issuer) claim of an ID Token during its authentication flow when the Issuer is known.
Jenkins
Jenkins Security Advisory 2024-10-02
vendor_jenkins·2024-10-02·CVSS 4.3
CVE-2024-47803 [MEDIUM] Jenkins Security Advisory 2024-10-02
Title: Jenkins Security Advisory 2024-10-02
Jenkins Security Advisory 2024-10-02
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Credentials
Plugin
OpenId Connect Authentication
Plugin
Descriptions
Exposure of multi-line secrets through error messages in Jenkins
SECURITY-3451
/
CVE-2024-47803
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-02
Published