CVE-2024-47807
First published: Wed Oct 02 2024(Updated: )
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token during its authentication flow, a value that identifies the Originating Party (IdP). This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins. OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the `iss` (Issuer) claim of an ID Token during its authentication flow when the Issuer is known.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins:oic-auth | <4.355.v3a | 4.355.v3a |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/mitre-cve
- source/MITRE
- agent/type
- agent/first-publish-date
- agent/author
- collector/nvd-api
- source/NVD
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8pjw-fff6-3mjv
- alias/CVE-2024-47807
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/nvd-cve
- package-manager/maven