Login Request a demo
OP
Product
Openid
by Jenkins · last CVE Dec 13, 2023
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 1High 1Medium 4Low 0
Severity
All severities6Critical1High1Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Openid to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-24444
9.8
1%
Jan 26
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login
Affected: through 2.4
CVE-2023-24446
8.8
1%
Jan 26
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account
Affected: through 2.4
CVE-2023-50770
6.7
0%
Dec 13
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers…
Affected: through 2.6
CVE-2019-1003099
6.5
2%
Apr 4
A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to…
Affected: through 2.3
CVE-2019-1003098
6.5
1%
Apr 4
A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a…
Affected: All versions, or not specified
CVE-2023-24445
6.1
1%
Jan 26
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins
Affected: through 2.4
Showing 6