Jenkins OpenId Connect Authentication Plugin lacks audience claim validation

高 8.1CVE-2024-47806 · GHSA-49hx-9mm2-7675 · 02/10/2024 公開 · 17/06/2026 更新

要点

CVE-2024-47806 は org.jenkins-ci.plugins:oic-auth, openid connect authentication (jenkins) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.63%（全脆弱性の 50.3% より高い）。
対処：4.355.v3a, 4.355.v3a_fb_fca_b_96d4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:oic-auth Maven	`< 4.355.v3a`	`4.355.v3a`
openid connect authentication jenkins	`< 4.355.v3a_fb_fca_b_96d4`	`4.355.v3a_fb_fca_b_96d4`

概要

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the aud (Audience) claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client.

This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the aud (Audience) claim of an ID Token during its authentication flow.

NVD の説明

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.