Vulnerability Details CVE-2023-50770
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 1.1%
CVSS Severity
CVSS v3 Score 6.7
References
Products affected by CVE-2023-50770
-
cpe:2.3:a:jenkins:openid:-
-
cpe:2.3:a:jenkins:openid:1.0
-
cpe:2.3:a:jenkins:openid:1.1
-
cpe:2.3:a:jenkins:openid:1.2
-
cpe:2.3:a:jenkins:openid:1.3
-
cpe:2.3:a:jenkins:openid:1.4
-
cpe:2.3:a:jenkins:openid:1.5
-
cpe:2.3:a:jenkins:openid:1.6
-
cpe:2.3:a:jenkins:openid:1.7
-
cpe:2.3:a:jenkins:openid:1.8
-
cpe:2.3:a:jenkins:openid:2.0
-
cpe:2.3:a:jenkins:openid:2.1
-
cpe:2.3:a:jenkins:openid:2.1.1
-
cpe:2.3:a:jenkins:openid:2.2
-
cpe:2.3:a:jenkins:openid:2.3
-
cpe:2.3:a:jenkins:openid:2.4
-
cpe:2.3:a:jenkins:openid:2.6