-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 2.292, <= 2.299 | 2.300 |
| org.jenkins-ci.main:jenkins-core | maven | <= 2.289.1 | 2.289.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing session invalidation during authentication. The commit diff shows the fix added session invalidation logic in AuthenticationProcessingFilter2.successfulAuthentication() when sessionFixationProtectionMode=2. The original code (before patch) lacked this critical security measure, making it possible to maintain a session across login events. The test case SecurityRealmSecurity2371Test explicitly verifies session ID changes post-login, confirming this was the vulnerable entry point.