CVE-2023-24444 Session fixation vulnerability in Jenkins OpenID Plugin
Attackers can hijack sessions because the Jenkins OpenID Plugin fails to invalidate previous sessions upon login.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-24444?
CVE-2023-24444 is a critical vulnerability in Jenkins OpenID Plugin, published on 24 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
Weakness: CWE-404
Which versions are affected by CVE-2023-24444?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:openid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:openid Maven | All versions to 2.4 | None |
org.jenkins-ci.plugins:openid Maven | All versions to 2.4 | None |
Products include Jenkins Openid.
How do I fix CVE-2023-24444?
No fix has been published for CVE-2023-24444 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-24444 being exploited?
There is no known exploitation of CVE-2023-24444 in the wild and no public exploit code.
Other vulnerabilities in Jenkins OpenID Plugin
- CVE-2023-24446 Cross-site request forgery vulnerability in Jenkins OpenID Plugin
- CVE-2023-50770 Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin
- CVE-2019-1003098 Jenkins OpenID Plugin CSRF vulnerability
- CVE-2019-1003099 Jenkins openid Plugin missing permission check
- CVE-2023-24445 Open redirect vulnerability in Jenkins OpenID Plugin
Sources
Also known as GHSA-f976-24hc-mjvr.