CVE-2024-52553 Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

High 8.8 Published 13 Nov 2024 Updated 13 Nov 2024

Attackers can maintain access via old sessions after login, potentially leading to account takeover in Jenkins environments using OpenId Connect.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-52553?

CVE-2024-52553 is a high-severity vulnerability in Jenkins OpenId Connect Authentication Plugin, published on 13 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.

Weakness: CWE-613

Which versions are affected by CVE-2024-52553?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:oic-auth. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:oic-auth` Maven	All versions	`4.421.v5422614eb`
`org.jenkins-ci.plugins:oic-auth` Maven	All versions	`4.421.v5422614eb`

Products include Jenkins Openid Connect Authentication.

How do I fix CVE-2024-52553?

Upgrade org.jenkins-ci.plugins:oic-auth to 4.421.v5422614eb or later.

Is CVE-2024-52553 being exploited?

There is no known exploitation of CVE-2024-52553 in the wild and no public exploit code.

Sources

Also known as GHSA-h23j-73ww-7594.