CVEvulnerability

CVE-2025-47884

9.1 CRITICAL Published 2025-05-14 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Weaknesses
CWE-284

Description

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

Affected configurations

• jenkins openid connect provider (<= 96.vee8ed882ec4d)

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References