Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-47806

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

Published

2024-10-02T16:15:10.807

Last Modified

2025-05-06T21:14:25.667

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application jenkins openid_connect_authentication < 4.355.v3a_fb_fca_b_96d4 Yes
References