8.8
High
CVE-2023-24446 A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick…
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins openid Plugin 2.4 | earliest → 2.4 | No fix stated |
Other CVEs of Jenkins openid Plugin
The 5 CVEs of Jenkins openid Plugin →
CVE-2023-24444
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login
9.8
Critical
CVE-2023-24445
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing…
6.1
Medium
CVE-2019-1003098
A cross-site request forgery vulnerability in Jenkins openid Plugin in the…
Not rated
CVE-2019-1003099
A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form…
Not rated