CVE-2023-50770

EPSS 0.3%

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

13 Dec 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

Affected products

Jenkins Project · Jenkins OpenId Connect Authentication Plugin

References

https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168 http://www.openwall.com/lists/oss-security/2023/12/13/4