~ / search / GHSA-hjh8-9gxh-cx4x

GHSA-hjh8-9gxh-cx4x

Jenkins CAS Plugin Session Fixation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-32997

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:cas-plugin < 1.6.3 1.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. CAS Plugin 1.6.3 invalidates the existing session on login.

References

External links from the advisory. They lead to third-party sites.