Session fixation vulnerability in Jenkins

🗓️ 24 May 2022 19:06:36Reported by GitHub Advisory DatabaseType

Session fixation vulnerability in Jenkins. Jenkins 2.299 and earlier, LTS 2.289.1 and earlier doesn't invalidate previous session on login, allowing attackers to gain admin access. Vulnerability introduced in Jenkins 2.266 and LTS 2.277.1. Jenkins 2.300, LTS 2.289.2 invalidates previous session on login. Admins can choose different implementation by setting Java system property 'hudson.security.SecurityRealm.sessionFixationProtectionMode' to '2', or disable the fix entirely by setting it to '0'

Reporter	Title	Published	Views	Family All 35
FreeBSD	jenkins -- multiple vulnerabilities	30 Jun 202100:00	–	freebsd
AlpineLinux	CVE-2021-21671	30 Jun 202117:15	–	alpinelinux
ArchLinux	[ASA-202107-5] jenkins: multiple issues	1 Jul 202100:00	–	archlinux
Circl	CVE-2021-21671	30 Jun 202120:30	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.249.31.0.6 / 2.277.40.0.1 / 2.289.2.2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-06-30)	11 Oct 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (9d271bab-da22-11eb-86f0-94c691a700a6)	2 Jul 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.289.2 / Jenkins weekly < 2.300 Multiple Vulnerabilities	30 Jun 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.8.15 (RHSA-2021:3820)	21 Oct 202100:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.8.15 (RHSA-2021:3820)	6 May 202600:00	–	nessus
CNNVD	Jenkins 授权问题漏洞	30 Jun 202100:00	–	cnnvd

Vulners

Node

org.jenkins-ci.main jenkins-coreRange≤2.289.1maven

org.jenkins-ci.main jenkins-coreRange2.292–2.299maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21671
jenkins	www.jenkins.io/security/advisory/2021-06-30/
openwall	www.openwall.com/lists/oss-security/2021/06/30/1
github	www.github.com/jenkinsci/jenkins/commit/25a42f3942fd9f8bd768c887c679dbc796b4fcd5
github	www.github.com/advisories/GHSA-4wr9-2xc6-jmg5

06 Dec 2023 21:36Current

7.5High risk

Vulners AI Score7.5

CVSS 25.1

CVSS 3.17.5

EPSS0.00273

CWE-384