CVE-2023-41935: 
Java vulnerability analysis and mitigation

CVE-2023-41935 affects the Microsoft Entra ID (previously Azure AD) Plugin for Jenkins. The vulnerability was discovered and disclosed on September 6, 2023, affecting versions up to and including 396.v86ce29279947, except version 378.380.v545b1154b3fb_. The vulnerability is related to the implementation of CSRF protection nonce validation (Jenkins Advisory, OSS Security).

The vulnerability stems from the plugin's use of a non-constant time comparison function when validating CSRF protection nonces. This implementation flaw occurs when checking whether the provided nonce matches the expected CSRF protection nonce. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could potentially allow attackers to use statistical methods to obtain a valid CSRF protection nonce. A successful exploitation could lead to bypassing CSRF protections, potentially allowing unauthorized actions to be performed on behalf of authenticated users (Jenkins Advisory).

The vulnerability has been fixed in Microsoft Entra ID Plugin version 397.v907382dd9b98, which implements a constant-time comparison when validating the nonce. Alternatively, users can use version 378.380.v545b1154b3fb which also contains the fix (Jenkins Advisory).