CVE-2023-37946

2023-07-1216:15:13

CWE-384

[email protected]

web.nvd.nist.gov

cve-2023-37946

jenkins

openshift

session invalidation

security vulnerability

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

53.7%

JSON

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

Affected configurations

NVD

Node

jenkinsopenshift_loginRange≤1.1.0.230.v5d7030b_f5432jenkins

VendorProductVersionCPE
jenkinsopenshift_logincpe:/a:jenkins:openshift_login::::

Vendor	Product	Version	CPE
jenkins	openshift_login		cpe:/a:jenkins:openshift_login::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins OpenShift Login Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.1.0.227.v27e08dfb_1a_20",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]