CVE-2023-50770

Name of the Vulnerable Software and Affected Versions Jenkins OpenId Connect Authentication Plugin versions 2.6 and earlier

Description The issue allows attackers with access to the Jenkins controller file system to recover the plain text password of a local user account used as an anti-lockout feature, likely gaining administrator access to Jenkins. This is due to the password being stored in a recoverable format.

Recommendations For versions 2.6 and earlier, update to a version later than 2.6 to resolve the issue. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of exploitation.