cbcvebase.
CVE-2023-24424
published 2023-01-26

CVE-2023-24424: Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.

PriorityP343high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.18%
64.0th percentile
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.

Affected

23 ranges
VendorProductVersion rangeFixed in
jenkinsbearychat_plugin——
jenkinsbitbucket_oauth_plugin——
jenkinscisco_spark_notifier_plugin——
jenkinsgerrit_trigger_plugin——
jenkinsgithub_pull_request_builder_plugin——
jenkinsgithub_pull_request_coverage_status_plugin——
jenkinsids_in_orka_by_macstadium_plugin——
jenkinsjira_pipeline_steps_plugin——
jenkinskeycloak_authentication_plugin——
jenkinskubernetes_credentials_provider_plugin——
jenkinsmacstadium_plugin——
jenkinsmstest_plugin——
jenkinsopenid_connect_authentication< 2.52.5
jenkinsopenid_connect_authentication_plugin——
jenkinsopenid_plugin——
jenkinsorka_by_macstadium_plugin——
jenkinspwauth_security_realm_plugin——
jenkinsrabbitmq_consumer_plugin——
jenkinsscript_security_plugin——
jenkinssemantic_versioning_plugin——
jenkinstestcomplete_support_plugin——
jenkinstestquality_updater_plugin——
jenkins_projectjenkins_openid_connect_authentication_pluginunspecified – 2.4—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.