Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2023-41935

UNKNOWN
Published 2023-09-06T12:08:55.693Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-41935. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins Project

Jenkins Azure AD Plugin

Affected Versions:

397.v907382dd9b_98 378.380.v545b_1154b_3fb_

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin

GHSA-hj7p-h74j-6gxj

Advisory Details

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.

Affected Packages

Maven org.jenkins-ci.plugins:azure-ad
ECOSYSTEM: ≥378.380.v545b <397.v907382dd9b
Maven org.jenkins-ci.plugins:azure-ad
ECOSYSTEM: ≥0 <378.vd6e2874a

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-41935
WEB https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3227
WEB http://www.openwall.com/lists/oss-security/2023/09/06/9

Advisory provided by GitHub Security Advisory Database. Published: September 6, 2023, Modified: January 30, 2024

References

https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3227
http://www.openwall.com/lists/oss-security/2023/09/06/9
Published: 2023-09-06T12:08:55.693Z
Last Modified: 2024-09-26T19:55:15.254Z
Copied to clipboard!