From 59dcbba61581bae68e1417b9d2f4e71b58ebaada Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 16 May 2025 14:44:08 +0000
Subject: [PATCH] Publish Advisories

GHSA-q7c3-x7hm-qq72
GHSA-q7c3-x7hm-qq72
---
 .../GHSA-q7c3-x7hm-qq72.json                  | 69 +++++++++++++++++++
 .../GHSA-q7c3-x7hm-qq72.json                  | 29 --------
 2 files changed, 69 insertions(+), 29 deletions(-)
 create mode 100644 advisories/github-reviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json
 delete mode 100644 advisories/unreviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json

diff --git a/advisories/github-reviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json b/advisories/github-reviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json
new file mode 100644
index 00000000000..39e098b76c7
--- /dev/null
+++ b/advisories/github-reviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q7c3-x7hm-qq72",
+  "modified": "2025-05-16T14:42:46Z",
+  "published": "2025-05-14T21:31:20Z",
+  "aliases": [
+    "CVE-2025-47884"
+  ],
+  "summary": "Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens",
+  "details": "In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "io.jenkins.plugins:oidc-provider"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "111.v29fd614b3617"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47884"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/oidc-provider-plugin/commit/29fd614b36171048ddc78a995ce44bd12bd7997d"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jenkinsci/oidc-provider-plugin"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/oidc-provider-plugin/releases/tag/111.v29fd614b_3617"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3574"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-16T14:42:45Z",
+    "nvd_published_at": "2025-05-14T21:15:59Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json b/advisories/unreviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json
deleted file mode 100644
index 51604ba2171..00000000000
--- a/advisories/unreviewed/2025/05/GHSA-q7c3-x7hm-qq72/GHSA-q7c3-x7hm-qq72.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-q7c3-x7hm-qq72",
-  "modified": "2025-05-14T21:31:20Z",
-  "published": "2025-05-14T21:31:20Z",
-  "aliases": [
-    "CVE-2025-47884"
-  ],
-  "details": "In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47884"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3574"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2025-05-14T21:15:59Z"
-  }
-}
\ No newline at end of file