PT-2023-19604 · Jenkins · Jenkins Openid Plugin+1

Kevin Guerroudj + 1 · Published 2023-01-24 · Updated 2023-02-02 · CVE-2023-24444

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins OpenID Plugin versions 2.4 and earlier

Description The issue arises because the plugin does not invalidate the previous session on login.

Recommendations For Jenkins OpenID Plugin versions 2.4 and earlier, update to a version later than 2.4 to resolve the issue.

Fix

Improper Resource Release

Session Fixation

Weakness Enumeration

CWE-404

CWE-384

Related Identifiers

CVE-2023-24444

GHSA-F976-24HC-MJVR

Affected Products

Jenkins

Jenkins Openid Plugin

References · 4

• https://jenkins.io/security/advisory/2023-01-24/#SECURITY-2996 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24444 · Security Note
• https://osv.dev/vulnerability/GHSA-f976-24hc-mjvr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-24444 · Vendor Advisory