PT-2023-24128 · Jenkins · Jenkins Cas Plugin+1

Kevin Guerroudj

·

CVE-2023-32997

·

Published

2023-05-16

·

Updated

2023-05-30

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Jenkins CAS Plugin versions 1.6.2 and earlier
Description The issue allows attackers to use social engineering techniques to gain administrator access to Jenkins because the previous session is not invalidated on login.
Recommendations For Jenkins CAS Plugin versions 1.6.2 and earlier, update to version 1.6.3 to invalidate the existing session on login.

Fix

Session Fixation

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2023-32997
GHSA-HJH8-9GXH-CX4X

Affected Products

Jenkins
Jenkins Cas Plugin