CVE-2023-24427: Critical severity jenkins bitbucket oauth vulnerability
Published Jan 24, 2023
·Updated
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
Affected Software
1 affected component
Jenkins Bitbucket Oauth Jenkins<=0.13
Event History
Jan 24, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-24427?
CVE-2023-24427 has been classified with a medium severity level due to session management vulnerabilities.
2
How do I fix CVE-2023-24427?
To fix CVE-2023-24427, upgrade the Jenkins Bitbucket OAuth Plugin to version 0.13 or later.
3
What are the potential risks associated with CVE-2023-24427?
The risks associated with CVE-2023-24427 include unauthorized access if a previous session remains active upon logging in.
4
Which versions of the Jenkins Bitbucket OAuth Plugin are affected by CVE-2023-24427?
CVE-2023-24427 affects versions of the Jenkins Bitbucket OAuth Plugin up to and including 0.12.
5
Is there a workaround for CVE-2023-24427 if I cannot upgrade immediately?
A potential workaround for CVE-2023-24427 is to manually invalidate sessions, though upgrading is highly recommended.