CVE-2025-47889

Description

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the WSO2 Oauth security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.1

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2023-30528,CVE-2023-30527,CVE-2023-33006,CVE-2023-33005,CVE-2025-47889 are affected in Jenkins - wso2id-oauth 1.0	Windows
Vulnerabilities CVE-2023-30528,CVE-2023-30527,CVE-2023-33006,CVE-2023-33005,CVE-2025-47889 are affected in Jenkins - wso2id-oauth for Linux 1.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234