CVE-2023-37946 - Vulnerability Details

Vendors	Products
Jenkins	Openshift Login
Jenkins Project	Jenkins Openshift Login Plugin
Redhat	Ocp Tools

Package	CPE	Advisory	Released Date
OCP-Tools-4.13-RHEL-8
jenkins-2-plugins-0:4.13.1706516346-1.el8	cpe:/a:redhat:ocp_tools:4.13::el8	RHSA-2024:0776	2024-02-12T00:00:00Z
OCP-Tools-4.14-RHEL-8
jenkins-2-plugins-0:4.14.1706516441-1.el8	cpe:/a:redhat:ocp_tools:4.14::el8	RHSA-2024:0777	2024-02-12T00:00:00Z
OpenShift Developer Tools and Services for OCP 4.11
jenkins-2-plugins-0:4.11.1706516946-1.el8	cpe:/a:redhat:ocp_tools:4.11::el8	RHSA-2024:0775	2024-02-12T00:00:00Z

Link	Providers
http://www.openwall.com/lists/oss-security/2023/07/12/2
https://nvd.nist.gov/vuln/detail/CVE-2023-37946
https://www.cve.org/CVERecord?id=CVE-2023-37946
https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998

Type	Values Removed	Values Added
First Time appeared		Jenkins Project Jenkins Project jenkins Openshift Login Plugin
CPEs		cpe:2.3:a:jenkins_project:jenkins_openshift_login_plugin::::::::
Vendors & Products		Jenkins Project Jenkins Project jenkins Openshift Login Plugin
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-37946", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2023-07-11T09:47:04.493Z", "datePublished": "2023-07-12T15:52:49.082Z", "dateUpdated": "2024-11-07T14:58:35.022Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Jenkins OpenShift Login Plugin", "vendor": "Jenkins Project", "versions": [{"lessThanOrEqual": "1.1.0.227.v27e08dfb_1a_20", "status": "affected", "version": "0", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "value": "Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:50:48.798Z"}, "references": [{"name": "Jenkins Security Advisory 2023-07-12", "tags": ["vendor-advisory"], "url": "https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998"}, {"url": "http://www.openwall.com/lists/oss-security/2023/07/12/2"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.795Z"}, "title": "CVE Program Container", "references": [{"name": "Jenkins Security Advisory 2023-07-12", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998"}, {"url": "http://www.openwall.com/lists/oss-security/2023/07/12/2", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "jenkins_project", "product": "jenkins_openshift_login_plugin", "cpes": ["cpe:2.3:a:jenkins_project:jenkins_openshift_login_plugin:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.0.227.v27e08dfb_1a_20", "versionType": "maven"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-07T14:57:26.356237Z", "id": "CVE-2023-37946", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T14:58:35.022Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-37946 (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

state : PUBLISHED (string)

assignerShortName : jenkins (string)

dateReserved : 2023-07-11T09:47:04.493Z (string)

datePublished : 2023-07-12T15:52:49.082Z (string)

dateUpdated : 2024-11-07T14:58:35.022Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Jenkins OpenShift Login Plugin (string)

vendor : Jenkins Project (string)

versions : [ »

0 : { »

lessThanOrEqual : 1.1.0.227.v27e08dfb_1a_20 (string)

status : affected (string)

version : 0 (string)

versionType : maven (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. (string)

}

]

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2023-10-24T12:50:48.798Z (string)

}

references : [ »

0 : { »

name : Jenkins Security Advisory 2023-07-12 (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 (string)

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/07/12/2 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T17:23:27.795Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : Jenkins Security Advisory 2023-07-12 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 (string)

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/07/12/2 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

affected : [ »

0 : { »

vendor : jenkins_project (string)

product : jenkins_openshift_login_plugin (string)

cpes : [ »

0 : cpe:2.3:a:jenkins_project:jenkins_openshift_login_plugin:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 1.1.0.227.v27e08dfb_1a_20 (string)

versionType : maven (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-11-07T14:57:26.356237Z (string)

id : CVE-2023-37946 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-07T14:58:35.022Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998", "name": "Jenkins Security Advisory 2023-07-12", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/07/12/2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.795Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-37946", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-07T14:57:26.356237Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jenkins_project:jenkins_openshift_login_plugin:*:*:*:*:*:*:*:*"], "vendor": "jenkins_project", "product": "jenkins_openshift_login_plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "1.1.0.227.v27e08dfb_1a_20"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T14:58:29.941Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins OpenShift Login Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "1.1.0.227.v27e08dfb_1a_20"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998", "name": "Jenkins Security Advisory 2023-07-12", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/07/12/2"}], "descriptions": [{"lang": "en", "value": "Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T12:50:48.798Z"}}}, "cveMetadata": {"cveId": "CVE-2023-37946", "state": "PUBLISHED", "dateUpdated": "2024-11-07T14:58:35.022Z", "dateReserved": "2023-07-11T09:47:04.493Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2023-07-12T15:52:49.082Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 (string)

name : Jenkins Security Advisory 2023-07-12 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/07/12/2 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T17:23:27.795Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-37946 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-07T14:57:26.356237Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:jenkins_project:jenkins_openshift_login_plugin:*:*:*:*:*:*:*:* (string)

]

vendor : jenkins_project (string)

product : jenkins_openshift_login_plugin (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : maven (string)

lessThanOrEqual : 1.1.0.227.v27e08dfb_1a_20 (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-07T14:58:29.941Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Jenkins Project (string)

product : Jenkins OpenShift Login Plugin (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : maven (string)

lessThanOrEqual : 1.1.0.227.v27e08dfb_1a_20 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 (string)

name : Jenkins Security Advisory 2023-07-12 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2023/07/12/2 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. (string)

}

]

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2023-10-24T12:50:48.798Z (string)

}

cveMetadata : { »

cveId : CVE-2023-37946 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-07T14:58:35.022Z (string)

dateReserved : 2023-07-11T09:47:04.493Z (string)

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

datePublished : 2023-07-12T15:52:49.082Z (string)

assignerShortName : jenkins (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:openshift_login:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "308AD760-A6A9-4855-92ED-AB2E7B5F6D36", "versionEndIncluding": "1.1.0.230.v5d7030b_f5432", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login."}], "id": "CVE-2023-37946", "lastModified": "2024-11-21T08:12:31.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-12T16:15:13.227", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/07/12/2"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/07/12/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:jenkins:openshift_login:*:*:*:*:*:jenkins:*:* (string)

matchCriteriaId : 308AD760-A6A9-4855-92ED-AB2E7B5F6D36 (string)

versionEndIncluding : 1.1.0.230.v5d7030b_f5432 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. (string)

}

]

id : CVE-2023-37946 (string)

lastModified : 2024-11-21T08:12:31.040 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-07-12T16:15:13.227 (string)

references : [ »

0 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2023/07/12/2 (string)

}

1 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2023/07/12/2 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 (string)

}

]

sourceIdentifier : jenkinsci-cert@googlegroups.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-384 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2024:0776", "cpe": "cpe:/a:redhat:ocp_tools:4.13::el8", "package": "jenkins-2-plugins-0:4.13.1706516346-1.el8", "product_name": "OCP-Tools-4.13-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2024:0777", "cpe": "cpe:/a:redhat:ocp_tools:4.14::el8", "package": "jenkins-2-plugins-0:4.14.1706516441-1.el8", "product_name": "OCP-Tools-4.14-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2024:0775", "cpe": "cpe:/a:redhat:ocp_tools:4.11::el8", "package": "jenkins-2-plugins-0:4.11.1706516946-1.el8", "product_name": "OpenShift Developer Tools and Services for OCP 4.11", "release_date": "2024-02-12T00:00:00Z"}], "bugzilla": {"description": "Jenkins: Session fixation vulnerability in OpenShift Login Plugin", "id": "2222709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222709"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-384", "details": ["Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.", "A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to bypass security restrictions caused by not invalidating the existing session on login. By persuading a victim to visit a specially crafted Web site, an attacker can gain administrator access to Jenkins."], "name": "CVE-2023-37946", "package_state": [{"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2023-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-37946\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-37946\nhttps://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998"], "threat_severity": "Important"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2024:0776 (string)

cpe : cpe:/a:redhat:ocp_tools:4.13::el8 (string)

package : jenkins-2-plugins-0:4.13.1706516346-1.el8 (string)

product_name : OCP-Tools-4.13-RHEL-8 (string)

release_date : 2024-02-12T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2024:0777 (string)

cpe : cpe:/a:redhat:ocp_tools:4.14::el8 (string)

package : jenkins-2-plugins-0:4.14.1706516441-1.el8 (string)

product_name : OCP-Tools-4.14-RHEL-8 (string)

release_date : 2024-02-12T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2024:0775 (string)

cpe : cpe:/a:redhat:ocp_tools:4.11::el8 (string)

package : jenkins-2-plugins-0:4.11.1706516946-1.el8 (string)

product_name : OpenShift Developer Tools and Services for OCP 4.11 (string)

release_date : 2024-02-12T00:00:00Z (string)

}

]

bugzilla : { »

description : Jenkins: Session fixation vulnerability in OpenShift Login Plugin (string)

id : 2222709 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2222709 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 8.8 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

status : verified (string)

}

cwe : CWE-384 (string)

details : [ »

0 : Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login. (string)

1 : A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to bypass security restrictions caused by not invalidating the existing session on login. By persuading a victim to visit a specially crafted Web site, an attacker can gain administrator access to Jenkins. (string)

]

name : CVE-2023-37946 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:openshift:3.11 (string)

fix_state : Out of support scope (string)

package_name : jenkins-2-plugins (string)

product_name : Red Hat OpenShift Container Platform 3.11 (string)

}

1 : { »

cpe : cpe:/a:redhat:openshift:4 (string)

fix_state : Affected (string)

package_name : jenkins-2-plugins (string)

product_name : Red Hat OpenShift Container Platform 4 (string)

}

]

public_date : 2023-07-12T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-37946 https://nvd.nist.gov/vuln/detail/CVE-2023-37946 https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2998 (string)

]

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object