Skip to content
OpenAdvisories
High · 8.8 CVE-2023-32997 EUVD-2023-1559GHSA-hjh8-9gxh-cx4x

Jenkins CAS Plugin Session Fixation vulnerability

Published May 16, 2023 · Updated Jan 23, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins CAS Plugin Package: org.jenkins-ci.plugins:cas-plugin Category: Web / CMS Ecosystem: Maven

Description

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins CAS Plugin ≤ 1.6.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:cas-plugin < 1.6.3 1.6.3 GHSA-hjh8-9gxh-cx4x

Advisories 1

References