What is GHSA-49hx-9mm2-7675?

GHSA-49hx-9mm2-7675 is a security advisory published by GitHub Security Advisories with Critical severity. Jenkins OpenId Connect Authentication Plugin lacks audience claim validation

Which CVE IDs does GHSA-49hx-9mm2-7675 cover?

GHSA-49hx-9mm2-7675 covers the following CVE IDs: CVE-2024-47806. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-49hx-9mm2-7675?

GHSA-49hx-9mm2-7675 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-49hx-9mm2-7675?

GHSA-49hx-9mm2-7675 affects 1 product, including: maven/org.jenkins-ci.plugins:oic-auth:\u003c 4.355.v3a.

GHSA-49hx-9mm2-7675CriticalCVSS 8.1

Jenkins OpenId Connect Authentication Plugin lacks audience claim validation

Vendor

GitHub Security Advisories

Published

October 2, 2024

Last Modified

October 2, 2024

🔗 CVE IDs covered (1)

CVE-2024-47806 →

📋 Description

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the aud (Audience) claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client.

This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the aud (Audience) claim of an ID Token during its authentication flow.

🎯 Affected products1

maven/org.jenkins-ci.plugins:oic-auth:< 4.355.v3a

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-47806
https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(1)
https://github.com/advisories/GHSA-49hx-9mm2-7675