9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-47884

CVE-2025-47884: Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-47884

CVE-2025-47884:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.jenkins.plugins:oidc-provider	maven	< 111.v29fd614b3617	111.v29fd614b_3617

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows attackers to craft build ID tokens by overriding environment variables. The provided commit 29fd614b36171048ddc78a995ce44bd12bd7997d addresses this in IdTokenCredentials.java. The key modification is the introduction of a new private static method getEnvironment(Run<?, ?> build, TaskListener listener) which is described as a 'Safer version of Run#getEnvironment(TaskListener) ... which prevents overrides.' The previous, vulnerable code used env = build.getEnvironment(TaskListener.NULL); to obtain environment variables. These variables were then used in a loop with Util.replaceMacro(claim.getValue(), env) to populate the claims of the ID token. The entire process of claim preparation and token generation is encapsulated by the public method IdTokenCredentials.compact(). This method uses the (previously insecurely populated) environment variables to construct the claims that go into the final token. Therefore, io.jenkins.plugins.oidc_provider.IdTokenCredentials.compact() is the function that would generate the malicious token when the vulnerability is exploited. The patch ensures that compact() now uses a sanitized set of environment variables. The added test cases (spoofedClaimsRunLevel and spoofedClaimsJobLevel) in IdTokenCredentialsTest.java further confirm this by attempting to spoof environment variables and verifying that the new getEnvironment method logs a warning about conflicting values, and the resulting token's claims are not based on the spoofed values.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.