jenkins_openid_connect_authentication

1.4 and earlier

OTHER 1 CVE

0

SINGLE_NUMBER 5 CVEs

unspecified

OTHER 1 CVE

2.4

MAJOR_MINOR 1 CVE

4.354.v321ce67a_1de8

OTHER 2 CVEs

2.6

MAJOR_MINOR 2 CVEs

4.418.vccc7061f5b_6d

OTHER 1 CVE

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.

HIGH Nov 13, 2024

CVE-2024-47807

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

HIGH Oct 02, 2024

CVE-2024-47806

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

HIGH Oct 02, 2024

CVE-2023-50771

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

UNKNOWN Dec 13, 2023

CVE-2023-50770

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

UNKNOWN Dec 13, 2023