Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14eHEyLTc0aHctdmc2bc4AAzXH

Jenkins WSO2 Oauth Plugin Session Fixation vulnerability

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

As of publication of this advisory, there is no fix.

Permalink: https://github.com/advisories/GHSA-xxq2-74hw-vg6m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14eHEyLTc0aHctdmc2bc4AAzXH
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 months ago
Updated: 6 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-xxq2-74hw-vg6m, CVE-2023-33005
References:

Blast Radius: 1.0

Affected Version Ranges: <= 1.0
No known fixed version