Jenkins SAML Plugin Session Fixation vulnerability

2022-05-1403:07:02

Google

osv.dev

0.001 Low

EPSS

Percentile

32.0%

JSON

A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session. SAML Plugin 1.0.7 invalidates the previous session during login and creates a new one.

CPENameOperatorVersion
org.jenkins-ci.plugins:samleq0.2
org.jenkins-ci.plugins:samleq1.0.3
org.jenkins-ci.plugins:samleq1.0.5
org.jenkins-ci.plugins:samleq0.4
org.jenkins-ci.plugins:samleq0.3
org.jenkins-ci.plugins:samleq0.12
org.jenkins-ci.plugins:samleq0.6
org.jenkins-ci.plugins:samleq1.0.4
org.jenkins-ci.plugins:samleq0.5
org.jenkins-ci.plugins:samleq1.0.6

Name	Operator	Version
org.jenkins-ci.plugins:saml	eq	0.2
org.jenkins-ci.plugins:saml	eq	1.0.3
org.jenkins-ci.plugins:saml	eq	1.0.5
org.jenkins-ci.plugins:saml	eq	0.4
org.jenkins-ci.plugins:saml	eq	0.3
org.jenkins-ci.plugins:saml	eq	0.12
org.jenkins-ci.plugins:saml	eq	0.6
org.jenkins-ci.plugins:saml	eq	1.0.4
org.jenkins-ci.plugins:saml	eq	0.5
org.jenkins-ci.plugins:saml	eq	1.0.6