What is GHSA-hjh8-9gxh-cx4x?

GHSA-hjh8-9gxh-cx4x is a security advisory published by GitHub Security Advisories with High severity. Jenkins CAS Plugin Session Fixation vulnerability

Which CVE IDs does GHSA-hjh8-9gxh-cx4x cover?

GHSA-hjh8-9gxh-cx4x covers the following CVE IDs: CVE-2023-32997. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hjh8-9gxh-cx4x?

GHSA-hjh8-9gxh-cx4x has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-hjh8-9gxh-cx4x?

GHSA-hjh8-9gxh-cx4x affects 1 product, including: maven/org.jenkins-ci.plugins:cas-plugin:\u003c 1.6.3.

GHSA-hjh8-9gxh-cx4xHighCVSS 8.8

Jenkins CAS Plugin Session Fixation vulnerability

Vendor

GitHub Security Advisories

Published

May 16, 2023

Last Modified

January 5, 2024

🔗 CVE IDs covered (1)

CVE-2023-32997 →

📋 Description

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

CAS Plugin 1.6.3 invalidates the existing session on login.

🎯 Affected products1

maven/org.jenkins-ci.plugins:cas-plugin:< 1.6.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-32997
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3000
https://github.com/jenkinsci/cas-plugin/commit/3a33cc0175bcc18801faf9125afb38d495b5995f
https://github.com/advisories/GHSA-hjh8-9gxh-cx4x