~ / search / GHSA-xxq2-74hw-vg6m

GHSA-xxq2-74hw-vg6m

Jenkins WSO2 Oauth Plugin Session Fixation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-33005

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:wso2id-oauth <= 1.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.