Jenkins Openid vulnerabilities

6 CVEs affecting Jenkins Openid, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-50770, published 2023-12-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-1003099, published 2019-04-04. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a…
CVE-2019-1003098, published 2019-04-04. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an…
CVE-2023-24444, published 2023-01-26. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
CVE-2023-24445, published 2023-01-26. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
CVE-2023-24446, published 2023-01-26. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2023-50770, published 2023-12-13. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the…