GCVE - cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Azure Ad (`ed432235-19f7-5d72-9d2b-90433c37b61a`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/jenkinsci/azure-ad-plugin`	purl2cpe	2026-06-01 10:14:16.875353

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-42525`	vulnerable	2026-06-08 08:03:16.475542	Details available Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. Published: 2026-04-29T13:31:33.582Z Updated: 2026-04-29T14:09:41.735Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3760	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-41935`	vulnerable	2026-06-08 06:11:07.444864	Details available Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce. Published: 2023-09-06T12:08:55.693Z Updated: 2024-09-26T19:55:15.254Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3227 http://www.openwall.com/lists/oss-security/2023/09/06/9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24426`	vulnerable	2026-06-08 05:56:05.447823	Details available Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T14:08:32.895Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2980	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21679`	vulnerable	2026-06-08 05:29:13.120685	Details available Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. Published: 2021-08-31T13:50:16.000Z Updated: 2024-08-03T18:23:29.177Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2470 http://www.openwall.com/lists/oss-security/2021/08/31/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2119`	vulnerable	2026-06-08 05:24:58.928667	Details available Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. Published: 2020-02-12T14:35:44.000Z Updated: 2024-08-04T07:01:41.123Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1717 http://www.openwall.com/lists/oss-security/2020/02/12/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-10318`	vulnerable	2026-06-08 05:12:23.155165	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.