PT-2025-21237 · Jenkins · Jenkins Openid Connect Provider Plugin+1

Jesse Glick · Published 2025-05-14 · Updated 2025-06-12 · CVE-2025-47884

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Connect Provider Plugin versions 96.vee8ed882ec4d and earlier

Description: The issue concerns the generation of build ID Tokens, which uses potentially overridden values of environment variables. This can be exploited by attackers who can configure jobs, allowing them to craft a build ID Token that impersonates a trusted job. This could potentially lead to unauthorized access to external services.

Recommendations: For Jenkins OpenID Connect Provider Plugin versions 96.vee8ed882ec4d and earlier, consider disabling the build ID Token generation feature until a patch is available to prevent potential impersonation attacks. Restrict access to job configuration to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-47884

GHSA-Q7C3-X7HM-QQ72

Affected Products

Jenkins

Jenkins Openid Connect Provider Plugin

References · 18

• https://jenkins.io/security/advisory/2025-05-14/#SECURITY-3574 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7c3-x7hm-qq72 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47884 · Security Note
• https://github.com/jenkinsci/oidc-provider-plugin · Note
• https://github.com/jenkinsci/oidc-provider-plugin/commit/29fd614b36171048ddc78a995ce44bd12bd7997d · Note
• https://github.com/jenkinsci/oidc-provider-plugin/releases/tag/111.v29fd614b_3617 · Note
• https://twitter.com/zoomeye_team/status/1923302816623321446 · Twitter Post
• https://twitter.com/syedaquib77/status/1922812825799655494 · Twitter Post
• https://twitter.com/dailycve/status/1933180764578816303 · Twitter Post
• https://t.me/cvetracker/23867 · Telegram Post
• https://twitter.com/Netlas_io/status/1923732602860540369 · Twitter Post
• https://t.me/cvenotify/125477 · Telegram Post
• https://twitter.com/Netlas_io/status/1923732319589818852 · Twitter Post
• https://twitter.com/CVEnew/status/1922765595013152790 · Twitter Post