Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.jenkins-ci.plugins:azure-ad(Maven) | 378.380.v545b | 397.v907382dd9b | N/A |
| org.jenkins-ci.plugins:azure-ad(Maven) | 0 | 378.vd6e2874a | N/A |
CVSS Metrics
