PT-2024-7984 · Jenkins · Jenkins Openid Connect Authentication Plugin+1

James Nord

·

Published

2024-10-01

·

Updated

2024-10-07

·

CVE-2024-47807

CVSS v4.0

9.2

Critical

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Jenkins OpenId Connect Authentication Plugin versions 4.354.v321ce67a 1de8 and earlier
Description The issue is related to a flaw in the authentication procedure of the Jenkins OpenId Connect plugin. This flaw allows a remote attacker to bypass the authentication process by exploiting the lack of verification of the iss (Issuer) claim in an ID Token. This could potentially grant the attacker administrator access to Jenkins.
Recommendations For Jenkins OpenId Connect Authentication Plugin versions 4.354.v321ce67a 1de8 and earlier, update to version 4.355.v3a fb fca b 96d4 or later, which includes a fix for this issue by checking the iss (Issuer) claim of an ID Token during the authentication flow when the Issuer is known. As a temporary workaround, consider restricting access to the Jenkins authentication flow to minimize the risk of exploitation until the update can be applied.

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-09497
CVE-2024-47807
GHSA-8PJW-FFF6-3MJV

Affected Products

Jenkins
Jenkins Openid Connect Authentication Plugin