GHSA-h23j-73ww-7594

ghsaUSosv

Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

view advisory published 2024-11-13Licence: CC-BY-4.0

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenId Connect Authentication Plugin 4.421.v5422614eb_e0a_ invalidates the existing session on login.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-52553US	—	0.66% (51st)	—	2024-11-13
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/oic-auth-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2024-52553ADVISORY
https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3473WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan