CVE-2024-47806

High

Description

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

SeverityHigh

CVSS8.1

Exploit probability—

Product

Jenkins Openid Connect Authentication

PublishedOct 2, 2024

First seenOct 2, 2024

Weakness typeCWE-287Improper authentication

How to fix

Update

jenkins openid_connect_authentication4.355.v3a_fb_fca_b_96d4 or later
org.jenkins-ci.plugins:oic-auth4.355.v3a or later

Vendor advisories

jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(1)

Affected products

Product	Affected versions	Fixed in
jenkins openid_connect_authentication	v < 4.355.v3a_fb_fca_b_96d4	4.355.v3a_fb_fca_b_96d4
org.jenkins-ci.plugins:oic-authMaven	v < 4.355.v3a	4.355.v3a

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.