CVE-2022-23106

Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token...

CVE-2022-23106

CVE-2022-23106 affects Jenkins Configuration as Code Plugin (versions up to 1.55). The issue is a non-constant time comparison when validating an authentication token, enabling attackers to use statistical methods to deduce a valid token. The available connected documents corroborate the vulnerab...