GHSA-4pjx-86pg-x4j5

ghsaUSosv

Jenkins SAML Plugin Session Fixation vulnerability

view advisory published 2022-05-14Licence: CC-BY-4.0

A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session. SAML Plugin 1.0.7 invalidates the previous session during login and creates a new one.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000602US	medium5.9	0.85% (58th)	—	2018-06-26
A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they c…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/saml-pluginPACKAGE
https://github.com/jenkinsci/saml-plugin/commit/fd95d576bda64b278071428c7fbee03c02f843c0WEB
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-916WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000602ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan