9.8
Critical
CVE-2023-24444 Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login
Description
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins openid Plugin 2.4 | earliest → 2.4 | No fix stated |
References
- www.jenkins.io www.jenkins.io
Timeline
- Published
- Last modified
Other CVEs of Jenkins openid Plugin
The 5 CVEs of Jenkins openid Plugin →
CVE-2023-24445
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing…
6.1
Medium
CVE-2023-24446
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick…
8.8
High
CVE-2019-1003098
A cross-site request forgery vulnerability in Jenkins openid Plugin in the…
Not rated
CVE-2019-1003099
A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form…
Not rated