CVE-2024-47807

Description

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token during its authentication flow, a value that identifies the Originating Party (IdP). This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins. OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the `iss` (Issuer) claim of an ID Token during its authentication flow when the Issuer is known.

How to fix CVE-2024-47807

To remediate CVE-2024-47807, upgrade the affected package to a fixed version below.

• —upgrade to 4.355.v3a or later

Is CVE-2024-47807 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 4.355.v3a

CVSS scores

References (2)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-47807
• WEBwww.jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(2)