Skip to content
OpenAdvisories
High · 8.8 CVE-2024-52553 EUVD-2024-3259GHSA-h23j-73ww-7594

Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

Published Nov 13, 2024 · Updated Nov 13, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins OpenId Connect Authentication Plugin Package: org.jenkins-ci.plugins:oic-auth Category: Web / CMS Ecosystem: Maven

Description

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins OpenId Connect Authentication Plugin ≤ 4.418.vccc7061f5b_6d —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:oic-auth < 4.421.v5422614eb 4.421.v5422614eb GHSA-h23j-73ww-7594

Advisories 1

References