| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:saml | < 1.0.7 | 1.0.7 |
| saml | ≤ 1.0.6 |
A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session. SAML Plugin 1.0.7 invalidates the previous session during login and creates a new one.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free