CVE-2024-52553: High severity jenkins openid connect authentication plugin vulnerability
Published Nov 13, 2024
·Updated
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login.
Affected Software
2 affected componentsFixes available
maven/org.jenkins-ci.plugins:oic-auth<4.421.v5422614eb
4.421.v5422614eb
jenkins Openid Connect Authentication Jenkins<4.421.v5422614eb_e0a
Event History
Nov 13, 2024
CVE Published
via MITRE·08:53 PM
Data Sourced
via MITRE·08:53 PM
Description
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-52553?
CVE-2024-52553 is considered a high severity vulnerability due to its potential to allow unauthorized access through session hijacking.
2
How do I fix CVE-2024-52553?
To fix CVE-2024-52553, upgrade the Jenkins OpenId Connect Authentication Plugin to version 4.421.v5422614eb or later.
3
What is the impact of CVE-2024-52553?
The impact of CVE-2024-52553 is that it allows attackers to exploit previous sessions, leading to unauthorized actions within the Jenkins environment.
4
Is CVE-2024-52553 a plugin vulnerability?
Yes, CVE-2024-52553 specifically affects the Jenkins OpenId Connect Authentication Plugin.
5
What versions are affected by CVE-2024-52553?
Versions of the Jenkins OpenId Connect Authentication Plugin prior to 4.421.v5422614eb are affected by CVE-2024-52553.