PT-2024-7984 · Jenkins · Jenkins Openid Connect Authentication Plugin+1
James Nord
·
Published
2024-10-01
·
Updated
2024-10-07
·
CVE-2024-47807
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Jenkins OpenId Connect Authentication Plugin versions 4.354.v321ce67a 1de8 and earlier
Description
The issue is related to a flaw in the authentication procedure of the Jenkins OpenId Connect plugin. This flaw allows a remote attacker to bypass the authentication process by exploiting the lack of verification of the
iss (Issuer) claim in an ID Token. This could potentially grant the attacker administrator access to Jenkins.Recommendations
For Jenkins OpenId Connect Authentication Plugin versions 4.354.v321ce67a 1de8 and earlier, update to version 4.355.v3a fb fca b 96d4 or later, which includes a fix for this issue by checking the
iss (Issuer) claim of an ID Token during the authentication flow when the Issuer is known.
As a temporary workaround, consider restricting access to the Jenkins authentication flow to minimize the risk of exploitation until the update can be applied.Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Openid Connect Authentication Plugin