Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: Jenkins OpenId Connect Authentication Plugin — Jenkins Security Advisory 2023-12-13 Clear all filters
TI-2023-27701 CVE-2023-50771 · GHSA-9qv8-7jfq-73j2

Open redirect in Jenkins OpenId Connect Authentication Plugin

Priority LOW 28

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.006 Published 2023-12-13 Fixed in 3.0 CWE-601
TI-2023-27700 CVE-2023-50770 · GHSA-6r5w-jjr5-qvgr

Insufficiently protected credentials in Jenkins OpenId Connect Authentication Plugin

Priority LOW 29

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller fil…

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00286 Published 2023-12-13 Fixed in 4.229.vf736b CWE-522