-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:saml | maven | <= 1.0.6 | 1.0.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper session management during the SAML login flow. The commit diff shows the patched version added a 'recreateSession()' call in doFinishLogin to invalidate the previous session. The unpatched doFinishLogin lacked this critical session invalidation step, making it possible to reuse a compromised session ID after authentication. This matches the CWE-384 (Session Fixation) description and the advisory's explanation that pre-authentication sessions weren't properly invalidated.