Jenkins OpenShift Login Plugin Session Bypass

The vulnerability of the Jenkins OpenShift Login plugin is related to improper session management. Exploiting this vulnerability allows a malicious actor to bypass security restrictions from a remote location...

CVE-2023-37947

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

CVE-2023-37946

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the previous session on login...

CVE-2023-37947: URL Redirection to Untrusted Site

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

CVE-2023-37946: Session Fixation

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb1a20 and earlier does not invalidate the previous session on login...

PT-2023-3964

Name of the Vulnerable Software and Affected Versions Jenkins OpenShift Login Plugin versions 1.1.0.227.v27e08dfb 1a 20 and earlier Description The issue is related to incorrect session management in the Jenkins OpenShift Login Plugin. This can allow a remote attacker to bypass security...

PT-2023-26194

Name of the Vulnerable Software and Affected Versions Jenkins OpenShift Login Plugin versions 1.1.0.227.v27e08dfb 1a 20 and earlier Description The issue improperly determines the legitimacy of a redirect URL after login, allowing attackers to perform phishing attacks. This is achieved by having...