Openid Connect Provider
Approved changes feed: RSS · Atom
cpe:2.3:a:jenkins:openid_connect_provider:*:*:*:*:*:jenkins:*:*
part: a version: * update: *
| Vendor | Jenkins (d708d718-2e77-5ca3-ae9c-38ee4d256744) |
|---|---|
| Product | Openid Connect Provider (ae6381c0-7382-5b78-89a4-d34e513ccb32) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | jenkins |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/jenkinsci/oidc-provider-plugin |
purl2cpe | 2026-06-01 10:14:16.589280 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-47884 |
vulnerable | 2026-06-08 07:27:14.968200 |
Details available
In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.
Published: 2025-05-14T20:35:54.646Z
Updated: 2025-05-15T13:35:32.601Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.