Vulnerabilidades do Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin: 2 registro(s), com versões afetadas e correções.

CVE-2026-84672 Alta · 8.8 CWE-639 02/09/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

CVE-2026-42525 Média · 4.3 CWE-601 29/04/2026

Open Redirect em Jenkins Azure Ad

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.