CVE-2025-47884

CRITICAL

Jenkins OpenID Connect Provider Plugin < 96.vee8ed882ec4d - Impersonation via Environment Variable Override

Title source: llm
STIX 2.1

Description

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

References (1)

Core 1
Core References

Scores

CVSS v3 9.1
EPSS 0.0093
EPSS Percentile 76.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (2)
io.jenkins.plugins/oidc-provider 0 - 111.v29fd614b_3617Maven
jenkins/openid_connect_provider < 96.vee8ed882ec4d
Published May 14, 2025
Tracked Since Feb 18, 2026