Session fixation vulnerability in Jenkins Keycloak Authentication Plugin

2023-01-2621:30:18

Google

osv.dev

0.002 Low

EPSS

Percentile

53.8%

JSON

Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.

CPENameOperatorVersion
org.jenkins-ci.plugins:keycloakeq2.0.2
org.jenkins-ci.plugins:keycloakeq2.1.0
org.jenkins-ci.plugins:keycloakeq2.3.0
org.jenkins-ci.plugins:keycloakeq2.0.3
org.jenkins-ci.plugins:keycloakeq2.2.0
org.jenkins-ci.plugins:keycloakeq2.1.1
org.jenkins-ci.plugins:keycloakeq2.0.1

Name	Operator	Version
org.jenkins-ci.plugins:keycloak	eq	2.0.2
org.jenkins-ci.plugins:keycloak	eq	2.1.0
org.jenkins-ci.plugins:keycloak	eq	2.3.0
org.jenkins-ci.plugins:keycloak	eq	2.0.3
org.jenkins-ci.plugins:keycloak	eq	2.2.0
org.jenkins-ci.plugins:keycloak	eq	2.1.1
org.jenkins-ci.plugins:keycloak	eq	2.0.1