CVE-2023-32997: 
Java vulnerability analysis and mitigation

Jenkins CAS Plugin version 1.6.2 and earlier contains a session fixation vulnerability (CVE-2023-32997) that was disclosed on May 16, 2023. The vulnerability affects the CAS Plugin for Jenkins, specifically versions up to and including 1.6.2. This security issue is related to the plugin's handling of user sessions during the login process (Jenkins Advisory).

The vulnerability stems from the plugin's failure to invalidate existing sessions upon user login. This is classified as a session fixation vulnerability with a CVSS v3.1 Base Score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The technical weakness is categorized under CWE-384 (Session Fixation) (NVD).

The vulnerability allows attackers to use social engineering techniques to potentially gain administrator access to Jenkins. This represents a significant security risk as it could lead to complete compromise of the Jenkins instance (Jenkins Advisory).

The vulnerability has been fixed in CAS Plugin version 1.6.3, which properly invalidates the existing session on login. Users are strongly advised to upgrade to this version or later to address the security issue (Jenkins Advisory).