Session Management Flaw in Jenkins Bitbucket OAuth Plugin by Jenkins

CVE-2023-24427

Summary

The Jenkins Bitbucket OAuth Plugin versions up to and including 0.12 contain a session management flaw that does not invalidate the previous session upon user login. This vulnerability allows an attacker to potentially exploit the session of a logged-in user if they manage to obtain a valid session identifier. It underscores the importance of ensuring that prior sessions are properly terminated during the authentication process to safeguard user accounts.

References