org.jenkins-ci.plugins:openid

5 results · Feed

• Critical 9.8
  CVE-2023-24444

  Session fixation vulnerability in Jenkins OpenID Plugin

  Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.

  Jenkins Project Jenkins openid Plugin org.jenkins-ci.plugins:openid Web / CMS Maven
  Jan 24, 2023
• High 8.8
  CVE-2023-24446

  Cross-site request forgery vulnerability in Jenkins OpenID Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.

  Jenkins Project Jenkins openid Plugin org.jenkins-ci.plugins:openid Web / CMS Maven
  Jan 24, 2023
• Medium 6.1
  CVE-2023-24445

  Open redirect vulnerability in Jenkins OpenID Plugin

  Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

  Jenkins Project Jenkins openid Plugin org.jenkins-ci.plugins:openid Web / CMS Maven
  Jan 24, 2023
• Medium 6.5
  CVE-2019-1003098

  Jenkins OpenID Plugin CSRF vulnerability

  A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.

  Jenkins Project Jenkins openid Plugin org.jenkins-ci.plugins:openid Web / CMS Maven
  Apr 4, 2019
• Medium 6.5
  CVE-2019-1003099

  Jenkins openid Plugin missing permission check

  A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

  Jenkins Project Jenkins openid Plugin org.jenkins-ci.plugins:openid Web / CMS Maven
  Apr 4, 2019