CVE-2023-37946

2023-07-1216:15:13

CWE-384

jenkins

web.nvd.nist.gov

cve-2023-37946

jenkins

openshift

session invalidation

security vulnerability

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

56.5%

JSON

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

Affected configurations

Nvd

Node

jenkinsopenshift_loginRange≤1.1.0.230.v5d7030b_f5432jenkins

VendorProductVersionCPE
jenkinsopenshift_login*cpe:2.3:a:jenkins:openshift_login:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	openshift_login	*	cpe:2.3:a:jenkins:openshift_login::::::jenkins::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins OpenShift Login Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.1.0.227.v27e08dfb_1a_20",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]