Jenkins Project Jenkins OpenID Plugin

• CVE-2023-24444 Critical 9.8 Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. 1.2%
• CVE-2023-24445 Medium 6.1 Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. 0.7%
• CVE-2023-24446 High 8.8 A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account. 0.6%