CVE-2024-47807: High severity jenkins openid connect authentication plugin vulnerability
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the iss (Issuer) claim of an ID Token during its authentication flow, a value that identifies the Originating Party (IdP).
This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
OpenId Connect Authentication Plugin 4.355.v3afbfcab96d4 checks the iss (Issuer) claim of an ID Token during its authentication flow when the Issuer is known.
Other sources
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a1de8 and earlier does not check the iss (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47807?
CVE-2024-47807 is considered a high severity vulnerability due to its potential to subvert the authentication process.
How do I fix CVE-2024-47807?
To fix CVE-2024-47807, upgrade the Jenkins OpenId Connect Authentication Plugin to version 4.355.v3a or later.
What systems are affected by CVE-2024-47807?
CVE-2024-47807 affects Jenkins OpenId Connect Authentication Plugin versions 4.354.v321ce67a_1de8 and earlier.
What does CVE-2024-47807 exploit?
CVE-2024-47807 exploits the lack of verification of the 'iss' (Issuer) claim in ID Tokens during the authentication flow.
Can CVE-2024-47807 lead to authentication bypass?
Yes, CVE-2024-47807 can potentially allow attackers to bypass authentication by manipulating the ID Token.