-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:azure-ad | maven | >= 378.380.v545b, <= 396.v86ce29279947 | 397.v907382dd9b |
| org.jenkins-ci.plugins:azure-ad | maven | < 378.vd6e2874a | 378.vd6e2874a |
Miggo AIRoot Cause AnalysisThe vulnerability centers on insecure nonce comparison using String.equals() which exhibits timing variations. The advisory explicitly mentions the root cause was non-constant time comparison, and standard Java security practice would require replacing String.equals() with MessageDigest.isEqual() in the nonce validation method. The AzureSecurityRealm class is the logical location for CSRF protection in this plugin architecture, containing the validateNonce method that would handle this comparison.