-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing session invalidation during login. In Jenkins authentication flows, the login completion handler (typically doFinishLogin in SecurityRealm implementations) is responsible for session management. The advisory specifically mentions session fixation through preserved sessions, indicating the login sequence doesn't properly cycle sessions. The OicSecurityRealm class would contain the authentication completion logic, and the absence of session.invalidate() calls before establishing new authentication credentials would leave previous sessions active. The high confidence comes from the direct match between the vulnerability description and standard session management practices in Jenkins plugins.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:oic-auth | maven | < 4.421.v5422614eb | 4.421.v5422614eb |
Ongoing coverage of React2Shell