QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-23903

Back to search

CVE-2024-23903

Published: Jan 24, 2024

Modified: Feb 13, 2025

PUBLISHED

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

VendorProductVersions

Jenkins Project

Jenkins GitLab Branch Source Plugin

affected
0 - <= 684.vea_fa_7c1e2fe3

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now