Jenkins CAS Plugin Session Fixation vulnerability

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. CAS Plugin 1.6.3 invalidates the existing session on login...

GHSA-HJH8-9GXH-CX4X Jenkins CAS Plugin Session Fixation vulnerability

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. CAS Plugin 1.6.3 invalidates the existing session on login...

CVE-2023-32997

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...

CVE-2023-32997

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...

Design/Logic Flaw

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...

CVE-2023-32997

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...

CVE-2023-32997

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...

CVE-2023-32997

The CVE-2023-32997 entry concerns the Jenkins CAS Plugin (versions 1.6.2 and earlier) that does not invalidate the existing session on login, enabling a session fixation risk. Multiple connected sources corroborate this behavior and describe it as allowing an attacker to potentially gain administ...

CVE-2023-32997

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...

PT-2023-24128 · Jenkins · Jenkins Cas Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CAS Plugin versions 1.6.2 and earlier Description: The issue allows attackers to use social engineering techniques to gain administrator access to Jenkins because the previous session is not invalidated on login. Recommendations: For...

CVE-2023-32997: Session Fixation

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login...

Session fixation vulnerability in cas-plugin

cas-plugin 1.6.2 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. cas-plugin 1.6.3 invalidates the existing session on login...

org.jenkins-ci.main:jenkins-test-harness (1.470), org.jenkins-ci.main:jenkins-war (1.470) +5 more potentially affected by CVE-2023-27898 via org.jenkins-ci.main:jenkins-core (1.470)

org.jenkins-ci.main:jenkins-core MAVEN version 1.470 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.470 - org.jenkins-ci.main:jenkins-war 1.470 -...

org.jenkins-ci.main:jenkins-test-harness (1.470), org.jenkins-ci.main:jenkins-war (1.470) +5 more potentially affected by CVE-2023-27899 via org.jenkins-ci.main:jenkins-core (1.470)

org.jenkins-ci.main:jenkins-core MAVEN version 1.470 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.470 - org.jenkins-ci.main:jenkins-war 1.470 -...

org.jenkins-ci.main:jenkins-test-harness (1.470), org.jenkins-ci.main:jenkins-war (1.470) +5 more potentially affected by CVE-2021-21671 via org.jenkins-ci.main:jenkins-core (1.470)

org.jenkins-ci.main:jenkins-core MAVEN version 1.470 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.470 - org.jenkins-ci.main:jenkins-war 1.470 -...

GHSA-2VVR-5757-QP87 Open redirect vulnerability in Jenkins CAS Plugin

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. Jenkins...

Open redirect vulnerability in Jenkins CAS Plugin

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. Jenkins...

org.jenkins-ci.main:jenkins-test-harness (1.470), org.jenkins-ci.main:jenkins-war (1.470) +5 more potentially affected by CVE-2021-21640 via org.jenkins-ci.main:jenkins-core (1.470)

org.jenkins-ci.main:jenkins-core MAVEN version 1.470 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.470 - org.jenkins-ci.main:jenkins-war 1.470 -...

org.jenkins-ci.main:jenkins-test-harness (1.470), org.jenkins-ci.main:jenkins-war (1.470) +5 more potentially affected by CVE-2020-2104 via org.jenkins-ci.main:jenkins-core (1.470)

org.jenkins-ci.main:jenkins-core MAVEN version 1.470 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.470 - org.jenkins-ci.main:jenkins-war 1.470 -...

org.jenkins-ci.main:jenkins-test-harness (1.470), org.jenkins-ci.main:jenkins-war (1.470) +5 more potentially affected by CVE-2016-3723 via org.jenkins-ci.main:jenkins-core (1.470)

org.jenkins-ci.main:jenkins-core MAVEN version 1.470 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.470 - org.jenkins-ci.main:jenkins-war 1.470 -...