A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session. SAML Plugin 1.0.7 invalidates the previous session during login and creates a new one.
References:GSA_kwCzR0hTQS00cGp4LTg2cGcteDRqNc4AAWed
Jenkins SAML Plugin Session Fixation vulnerability
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.jenkins-ci.plugins:saml | <= 1.0.6 | 1.0.7 | |
|
|
|||