Jenkins Azure AD Plugin <=396 Non-const Time CSRF Nonce Compare
CVE-2023-41935 Published on September 6, 2023
Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.
Products Associated with CVE-2023-41935
Want to know whenever a new CVE is published for Jenkins Azure Ad? stack.watch will email you.
Affected Versions
Jenkins Project Jenkins Azure AD Plugin:- Version 397.v907382dd9b_98 and below * is unaffected.
- Version 378.380.v545b_1154b_3fb_ and below 378.* is unaffected.
Exploit Probability
EPSS
0.10%
Percentile
26.97%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.