CVE-2024-23903

Summary

CVE-2024-23903 is a vulnerability affecting the Jenkins GitLab Branch Source Plugin version 684 and earlier. The issue lies in the plugin's implementation of a token comparison function, which is not constant time. This weakness allows attackers to use statistical methods to obtain valid webhook tokens by analyzing the differences in response times. The vulnerability poses a risk of unauthorized access to Jenkins environments through webhook tokens. Users are advised to update the plugin to the latest version to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.