Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-47884

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

Published

2025-05-14T21:15:59.363

Last Modified

2025-06-12T13:48:38.967

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-284
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application jenkins openid_connect_provider ≤ 96.vee8ed882ec4d Yes
References