high8.8
CVE-2024-52553
Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin
Impact
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenId Connect Authentication Plugin 4.421.v5422614eb_e0a_ invalidates the existing session on login.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:oic-auth | < 4.421.v5422614eb | 4.421.v5422614eb |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Openid Connect Authentication | before 4.421.v5422614eb_e0a |