Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-24444 EUVD-2023-0454GHSA-f976-24hc-mjvr

Session fixation vulnerability in Jenkins OpenID Plugin

Published Jan 24, 2023 · Updated Apr 2, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins openid Plugin Package: org.jenkins-ci.plugins:openid Category: Web / CMS Ecosystem: Maven

Description

Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins OpenID Plugin unspecified – ≤ 2.4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:openid <= 2.4 — GHSA-f976-24hc-mjvr

Advisories 1

References