GCVE - cpe:2.3:a:jenkins:wso2_oauth:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:wso2_oauth:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Wso2 Oauth (`4fab9537-f2f9-51b7-bb74-dee40390cfc3`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-47889`	vulnerable	2026-06-08 07:27:14.978583	Details available In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist. Published: 2025-05-14T20:35:58.095Z Updated: 2025-05-19T15:25:14.896Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-33005`	vulnerable	2026-06-08 06:04:48.172764	Details available Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login. Published: 2023-05-16T16:00:20.871Z Updated: 2025-01-23T15:38:06.819Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2991	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-30528`	vulnerable	2026-06-08 06:04:39.716461	Details available Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it. Published: 2023-04-12T17:05:16.410Z Updated: 2025-02-07T18:21:03.216Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992 http://www.openwall.com/lists/oss-security/2023/04/13/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-30527`	vulnerable	2026-06-08 06:04:39.715754	Details available Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Published: 2023-04-12T17:05:15.700Z Updated: 2025-02-07T18:22:44.370Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992 http://www.openwall.com/lists/oss-security/2023/04/13/3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.