3259 matches found
CVE-2023-24446
A cross-site request forgery CSRF vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-24446
CVE-2023-24446 is a CSRF vulnerability in the Jenkins OpenID Plugin (versions 2.4 and earlier) that lets an attacker trick a logged-in user into authenticating to the attacker’s account. The issue arises in the OpenID login flow (login request handling) where existing sessions aren’t protected ad...
CVE-2023-24424
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login...
CVE-2023-24445
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins...
CVE-2023-24446
A cross-site request forgery CSRF vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account...
PT-2023-19605 · Jenkins · Jenkins Openid Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Plugin versions 2.4 and earlier Description: The issue is related to the improper determination of redirect URLs after login, which could potentially allow unauthorized access. The estimated number of potentially affected devic...
PT-2023-19604 · Jenkins · Jenkins Openid Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Plugin versions 2.4 and earlier Description: The issue arises because the plugin does not invalidate the previous session on login. Recommendations: For Jenkins OpenID Plugin versions 2.4 and earlier, update to a version later...
CVE-2023-24445
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins...
Open redirect vulnerability in openid
openid 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. As of publication of...
Session fixation vulnerability in openid
openid 2.4 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. As of publication of this advisory, there is no fix. Learn why we announce this...
CSRF vulnerability in openid
openid 2.4 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker's account. As of publication of this advisory, there is n...
CVE-2023-24424
CVE-2023-24424 affects the Jenkins OpenId Connect Authentication Plugin (versions 2.4 and earlier). The vulnerability arises because the plugin does not invalidate an existing session on login, enabling potential unauthorized access via social engineering or session fixation. Reported impact is h...
CVE-2023-24424
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login...
PT-2023-19606 · Jenkins · Jenkins Openid Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Plugin versions 2.4 and earlier Description: A cross-site request forgery issue allows attackers to trick users into logging in to the attacker's account. Recommendations: For Jenkins OpenID Plugin versions 2.4 and earlier,...
CVE-2023-24444
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login...
CVE-2023-24444
CVE-2023-24444 affects Jenkins OpenID Plugin 2.4 and earlier. The root cause is that login does not invalidate the prior session, enabling session fixation risks. Evidence from multiple sources notes that OpenID Plugin 2.5 starts invalidating the existing session on login, providing a remediation...
CVE-2023-24445
CVE-2023-24445 affects Jenkins OpenID Plugin 2.4 and earlier, which improperly determines that a redirect URL after login points to Jenkins, enabling phishing via open redirects. Public documents (NVD, ENISA EUVD, Red Hat, GHSA, OSS OSV, Tenable Nessus) consistently describe this open redirect is...
CVE-2023-24446
A cross-site request forgery CSRF vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account...
