PT-2024-32822 · Jenkins · Jenkins Openid Connect Authentication Plugin+1
James Nord
·
Published
2024-10-02
·
Updated
2024-10-07
·
CVE-2024-47806
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Jenkins OpenId Connect Authentication Plugin versions 4.354.v321ce67a 1de8 and earlier
Description
The issue concerns the Jenkins OpenId Connect Authentication Plugin, which does not check the
aud (Audience) claim of an ID Token during its authentication flow. This allows attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins. The aud claim is a value used to verify that the token is issued for the correct client.Recommendations
For Jenkins OpenId Connect Authentication Plugin versions 4.354.v321ce67a 1de8 and earlier, update to version 4.355.v3a fb fca b 96d4 or later, which checks the
aud (Audience) claim of an ID Token during its authentication flow. As a temporary workaround, consider reviewing configurations for unauthorized access and restricting access to sensitive areas of Jenkins until the update can be applied.Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Openid Connect Authentication Plugin