CVE-2023-37946

Jenkins OpenShift Login Plugin session fixation vulnerability

8.8 HighFix available

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.83%Up 0.8 points since Jul 14, 2023

What each source reports

NVD Score used 8.8

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

Record: CVE-2023-37946
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-384
Updated: 2026-11-02

CVE List No score

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

Record: CVE-2023-37946
Updated: 2026-11-02

EUVDEUVD-2023-2142 0.0

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

Record: EUVD-2023-2142
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rwg5-2pv9-633w 8.8

Jenkins OpenShift Login Plugin session fixation vulnerability

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 invalidates the existing session on login.

Record: GHSA-rwg5-2pv9-633w
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-384
Updated: 2026-11-02

OSVGHSA-rwg5-2pv9-633w 8.8

Jenkins OpenShift Login Plugin session fixation vulnerability

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 invalidates the existing session on login.

Record: GHSA-rwg5-2pv9-633w
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-384
Updated: 2026-11-02

OSVRHSA-2024:0775 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record: RHSA-2024:0775
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:0776 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record: RHSA-2024:0776
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:0777 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record: RHSA-2024:0777
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.openshift.jenkins:openshift-login` Maven	before 1.1.0.230.v5d7030b	1.1.0.230.v5d7030b
`org.openshift.jenkins:openshift-login` Maven	before 1.1.0.230.v5d7030b, plus listed versions 0.10.100.110.120.2 Show 38 moreShow less 0.30.40.50.60.70.80.91.0.01.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.0.227.v27e08dfb_1a_20	1.1.0.230.v5d7030b
`jenkins-2-plugins` Red Hat:ocp_tools:4.11::el8 From an advisory covering 11 CVEs	before 0:4.11.1706516946-1.el8	0:4.11.1706516946-1.el8
`jenkins` Red Hat:ocp_tools:4.11::el8 From an advisory covering 11 CVEs	before 0:2.426.3.1706516929-3.el8	0:2.426.3.1706516929-3.el8
`jenkins-2-plugins` Red Hat:ocp_tools:4.13::el8 From an advisory covering 10 CVEs	before 0:4.13.1706516346-1.el8	0:4.13.1706516346-1.el8
`jenkins` Red Hat:ocp_tools:4.13::el8 From an advisory covering 10 CVEs	before 0:2.426.3.1706516254-3.el8	0:2.426.3.1706516254-3.el8
`jenkins-2-plugins` Red Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs	before 0:4.14.1706516441-1.el8	0:4.14.1706516441-1.el8
`jenkins` Red Hat:ocp_tools:4.14::el8 From an advisory covering 17 CVEs	before 0:2.426.3.1706516352-3.el8	0:2.426.3.1706516352-3.el8

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-37946 is a high vulnerability (CVSS 8.8) in Jenkins Openshift Login, published July 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in org.openshift.jenkins:openshift-login 1.1.0.230.v5d7030b.

References

Show 157 moreShow less