CVE-2023-24445

CVE-2023-24445 affects Jenkins OpenID Plugin 2.4 and earlier, which improperly determines that a redirect URL after login points to Jenkins, enabling phishing via open redirects. Public documents (NVD, ENISA EUVD, Red Hat, GHSA, OSS OSV, Tenable Nessus) consistently describe this open redirect is...

CVE-2023-24444

CVE-2023-24444 affects Jenkins OpenID Plugin 2.4 and earlier. The root cause is that login does not invalidate the prior session, enabling session fixation risks. Evidence from multiple sources notes that OpenID Plugin 2.5 starts invalidating the existing session on login, providing a remediation...

CVE-2019-1003099

CVE-2019-1003099 affects the Jenkins openid Plugin. The issue is a missing permission check in OpenIdSsoSecurityRealm.doValidate, allowing attackers with Overall/Read permission to initiate a connection to an attacker-specified server. Connected sources confirm the vulnerability scope (Jenkins Op...

CVE-2023-24446

CVE-2023-24446 is a CSRF vulnerability in the Jenkins OpenID Plugin (versions 2.4 and earlier) that lets an attacker trick a logged-in user into authenticating to the attacker’s account. The issue arises in the OpenID login flow (login request handling) where existing sessions aren’t protected ad...

CVE-2019-1003098

CVE-2019-1003098 describes a cross-site request forgery in the Jenkins OpenID Plugin, specifically in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation. The vulnerability allows attackers to initiate a connection to an attacker-specified server by abusing CSRF in the plugin’s v...

CVE-2023-50770

CVE-2023-50770 affects Jenkins OpenId Connect Authentication Plugin (versions 2.6 and earlier). The root cause is storing a local user password used as an anti-lockout feature in a recoverable format. This enables an attacker with access to the Jenkins controller filesystem to recover the plain t...