Publish Advisories

GHSA-p89h-p4ph-4vj6 GHSA-p89h-p4ph-4vj6
2026-05-22 18:04:22 -07:00 · 2025-05-16 14:52:52 +00:00
parent 9647f1ab88
commit 9f8f8cb08c
2 changed files with 61 additions and 29 deletions
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p89h-p4ph-4vj6",
+  "modified": "2025-05-16T14:49:27Z",
+  "published": "2025-05-14T21:31:20Z",
+  "aliases": [
+    "CVE-2025-47889"
+  ],
+  "summary": "Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials",
+  "details": "In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the \"WSO2 Oauth\" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:wso2id-oauth"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47889"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1390"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-16T14:49:27Z",
+    "nvd_published_at": "2025-05-14T21:15:59Z"
+  }
+}
@@ -1,29 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-p89h-p4ph-4vj6",
-  "modified": "2025-05-14T21:31:20Z",
-  "published": "2025-05-14T21:31:20Z",
-  "aliases": [
-    "CVE-2025-47889"
-  ],
-  "details": "In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the \"WSO2 Oauth\" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47889"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2025-05-14T21:15:59Z"
-  }
-}