Lucene search

K
nvd[email protected]NVD:CVE-2023-24426
HistoryJan 26, 2023 - 9:18 p.m.

CVE-2023-24426

2023-01-2621:18:16
CWE-613
web.nvd.nist.gov
8
cve-2023-24426
jenkins
azure ad plugin
session validation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

58.5%

Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.

Affected configurations

Nvd
Node
jenkinsazure_adRange303.va_91ef20ee49fjenkins
VendorProductVersionCPE
jenkinsazure_ad*cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:*

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

58.5%