CVE-2023-41935
Summary
| CVE | CVE-2023-41935 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-06 13:15:00 UTC |
| Updated | 2023-09-11 17:54:00 UTC |
| Description | Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce. |
Risk And Classification
Problem Types: CWE-697
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - Multiple vulnerabilities in Jenkins plugins | MISC | www.openwall.com | |
| Jenkins Security Advisory 2023-09-06 | MISC | www.jenkins.io | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 996987 Java (Maven) Security Update for org.jenkins-ci.plugins:azure-ad (GHSA-hj7p-h74j-6gxj)