GitHub Advisoryadvisory · Maven

GHSA-f976-24hc-mjvr Session fixation vulnerability in Jenkins OpenID Plugin

HIGH Published 2023-01-26 Modified 2023-01-27 Official page ↗

Aliases: CVE-2023-24444
Ecosystem: Maven
Packages: org.jenkins-ci.plugins:openid
Severity: High
Weaknesses: CWE-384
Reviewed: 2023-01-27

Affected packages

• Maven org.jenkins-ci.plugins:openid: <= 2.4 (no fix yet)

Description

Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.

Related

Alias · CVE (1)

CVE-2023-24444 Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. vulnerability

Weakness · CWE (1)

CWE-384 Session Fixation weakness

References