CVE-2023-24444 Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login

Description

Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins openid Plugin 2.4	earliest → 2.4	No fix stated

Other CVEs of Jenkins openid Plugin

The 5 CVEs of Jenkins openid Plugin →

CVE-2023-24445 Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing… 6.1 Medium CVE-2023-24446 A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick… 8.8 High CVE-2019-1003098 A cross-site request forgery vulnerability in Jenkins openid Plugin in the… Not rated CVE-2019-1003099 A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form… Not rated