PT-2023-24128 · Jenkins · Jenkins Cas Plugin+1

Kevin Guerroudj · Published 2023-05-16 · Updated 2023-05-30 · CVE-2023-32997

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins CAS Plugin versions 1.6.2 and earlier

Description The issue allows attackers to use social engineering techniques to gain administrator access to Jenkins because the previous session is not invalidated on login.

Recommendations For Jenkins CAS Plugin versions 1.6.2 and earlier, update to version 1.6.3 to invalidate the existing session on login.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2023-32997

GHSA-HJH8-9GXH-CX4X

Affected Products

Jenkins

Jenkins Cas Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2023-32997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32997 · Security Note
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3000 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hjh8-9gxh-cx4x · Vendor Advisory
• https://github.com/jenkinsci/cas-plugin/commit/3a33cc0175bcc18801faf9125afb38d495b5995f · Note
• https://t.me/cvenotify/51364 · Telegram Post
• https://t.me/cvenotify/50574 · Telegram Post