CVE-2024-52553 - Vulnerability Details - OpenCVE

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00162.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Jenkins	Openid Openid Connect Authentication

Configuration 1 [-]

cpe:2.3:a:jenkins:openid_connect_authentication:*:*:*:*:*:jenkins:*:*

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-h23j-73ww-7594	Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3473

History

Wed, 07 May 2025 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jenkins openid Connect Authentication
CPEs		cpe:2.3:a:jenkins:openid_connect_authentication::::::jenkins::*
Vendors & Products		Jenkins openid Connect Authentication

Wed, 13 Nov 2024 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jenkins Jenkins openid
Weaknesses		CWE-613
CPEs		cpe:2.3:a:jenkins:openid:-:::::jenkins::
Vendors & Products		Jenkins Jenkins openid
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 13 Nov 2024 21:00:00 +0000

Type	Values Removed	Values Added
Description		Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.
References		https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3473

MITRE

Status: PUBLISHED

Assigner: jenkins

Published: 2024-11-13T20:53:02.980Z

Updated: 2024-11-13T21:38:06.118Z

Reserved: 2024-11-12T15:28:28.980Z

Link: CVE-2024-52553

Vulnrichment

Updated: 2024-11-13T21:37:56.357Z

NVD

Status : Analyzed

Published: 2024-11-13T21:15:29.473

Modified: 2025-05-07T14:15:02.663

Link: CVE-2024-52553

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-52553", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2024-11-12T15:28:28.980Z", "datePublished": "2024-11-13T20:53:02.980Z", "dateUpdated": "2024-11-13T21:38:06.118Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-11-13T20:53:02.980Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins OpenId Connect Authentication Plugin", "versions": [{"version": "0", "versionType": "maven", "lessThanOrEqual": "4.418.vccc7061f5b_6d", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login."}], "references": [{"name": "Jenkins Security Advisory 2024-11-13", "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3473", "tags": ["vendor-advisory"]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-613", "lang": "en", "description": "CWE-613 Insufficient Session Expiration"}]}], "affected": [{"vendor": "jenkins", "product": "openid", "cpes": ["cpe:2.3:a:jenkins:openid:-:*:*:*:*:jenkins:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.418.vccc7061f5b_6d", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-13T21:38:03.003277Z", "id": "CVE-2024-52553", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-13T21:38:06.118Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-52553", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-13T21:38:03.003277Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jenkins:openid:-:*:*:*:*:jenkins:*:*"], "vendor": "jenkins", "product": "openid", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.418.vccc7061f5b_6d"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-13T21:37:56.357Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins OpenId Connect Authentication Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "4.418.vccc7061f5b_6d"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3473", "name": "Jenkins Security Advisory 2024-11-13", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2024-11-13T20:53:02.980Z"}}}, "cveMetadata": {"cveId": "CVE-2024-52553", "state": "PUBLISHED", "dateUpdated": "2024-11-13T21:38:06.118Z", "dateReserved": "2024-11-12T15:28:28.980Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2024-11-13T20:53:02.980Z", "assignerShortName": "jenkins"}, "dataVersion": "5.1"}