← Back to CVEs

CVE-2023-50770

MEDIUM

6.7

Description

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

CVE Details

CVSS v3.1 Score6.7

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published12/13/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

jenkins:openid

Weaknesses (CWE)

CWE-522

References

http://www.openwall.com/lists/oss-security/2023/12/13/4(jenkinsci-cert@googlegroups.com)

https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168(jenkinsci-cert@googlegroups.com)

http://www.openwall.com/lists/oss-security/2023/12/13/4(af854a3a-2127-422b-91ae-364da2661108)

https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.