PT-2024-35375 · Jenkins · Jenkins Openid Connect Authentication Plugin+1

Kevin Guerroudj · Published 2024-11-13 · Updated 2024-11-15 · CVE-2024-52553

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins OpenId Connect Authentication Plugin versions 4.418.vccc7061f5b 6d and earlier

Description The issue arises because the plugin does not invalidate the previous session on login, allowing attackers to potentially use social engineering techniques to gain administrator access to Jenkins.

Recommendations For Jenkins OpenId Connect Authentication Plugin versions 4.418.vccc7061f5b 6d and earlier, update to version 4.421.v5422614eb e0a or later to ensure the existing session is invalidated on login.

Fix

Insufficient Session Expiration

Session Fixation

Weakness Enumeration

CWE-613

CWE-384

Related Identifiers

CVE-2024-52553

GHSA-H23J-73WW-7594

Affected Products

Jenkins

Jenkins Openid Connect Authentication Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-h23j-73ww-7594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52553 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/714355 · Security Note
• https://jenkins.io/security/advisory/2024-11-13/#SECURITY-3473 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52553 · Vendor Advisory
• https://github.com/jenkinsci/oic-auth-plugin · Note
• https://t.me/cvedetector/10881 · Telegram Post
• https://twitter.com/CVEnew/status/1856828011905257622 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1856836348574896448 · Twitter Post