CVE Vulnerabilities

CVE-2023-37946

Session Fixation

Published: Jul 12, 2023 | Modified: Nov 21, 2024
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
8.8 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

Weakness

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Affected Software

Name Vendor Start Version End Version
Openshift_login Jenkins * 1.1.0.230.v5d7030b_f5432 (including)
OCP-Tools-4.13-RHEL-8 RedHat jenkins-2-plugins-0:4.13.1706516346-1.el8 *
OCP-Tools-4.14-RHEL-8 RedHat jenkins-2-plugins-0:4.14.1706516441-1.el8 *
OpenShift Developer Tools and Services for OCP 4.11 RedHat jenkins-2-plugins-0:4.11.1706516946-1.el8 *

Extended Description

Such a scenario is commonly observed when:

In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user’s account through the active session.

Potential Mitigations

References