PT-2023-3964 · Jenkins · Jenkins Openshift Login Plugin+1

Kevin Guerroudj + 1 · Published 2023-07-12 · Updated 2023-07-26 · CVE-2023-37946

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins OpenShift Login Plugin versions 1.1.0.227.v27e08dfb 1a 20 and earlier

Description The issue is related to incorrect session management in the Jenkins OpenShift Login Plugin. This can allow a remote attacker to bypass security restrictions. The problem arises because the plugin does not invalidate the previous session on login, which can be exploited using social engineering techniques to gain administrator access to Jenkins.

Recommendations For Jenkins OpenShift Login Plugin versions 1.1.0.227.v27e08dfb 1a 20 and earlier, update to version 1.1.0.230.v5d7030b f5432 or later, which invalidates the existing session on login. As a temporary workaround, consider restricting access to the plugin until the update can be applied.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2023-04259

CVE-2023-37946

GHSA-RWG5-2PV9-633W

RHSA-2024:0775

RHSA-2024:0776

RHSA-2024:0777

Affected Products

Jenkins

Jenkins Openshift Login Plugin

References · 11

• https://jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rwg5-2pv9-633w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37946 · Security Note
• https://bdu.fstec.ru/vul/2023-04259 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/696428/?sphrase_id=45673 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37946 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/696428 · Security Note
• https://t.me/cvenotify/54347 · Telegram Post
• https://t.me/cvenotify/55213 · Telegram Post
• https://access.redhat.com/security/cve/cve-2023-37946 · Note
• http://openwall.com/lists/oss-security/2023/07/12/2 · Note