En bref
- CVE-2025-47889 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant org.jenkins-ci.plugins:wso2id-oauth, wso2 oauth (jenkins).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.65%, plus élevée que 51.1% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
Description
In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.
NVD description
In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.
Autres vulnérabilités de org.jenkins-ci.plugins:wso2id-oauth
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free