Description
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
Remediation
References
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2996
Related Vulnerabilities
CVE-2020-2306 Vulnerability in maven package org.jenkins-ci.plugins:mercurial
CVE-2019-1351 Vulnerability in maven package org.webjars.npm:nodegit
CVE-2021-31409 Vulnerability in maven package com.vaadin:vaadin-compatibility-server
CVE-2017-1000387 Vulnerability in maven package org.jenkins-ci.plugins:build-publisher
CVE-2023-31058 Vulnerability in maven package org.apache.inlong:manager-common