Описание
Open redirect vulnerability in Jenkins CAS Plugin
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.
Jenkins CAS Plugin 1.6.1 only redirects to relative (Jenkins) URLs.
Пакеты
Наименование
org.jenkins-ci.plugins:cas-plugin
maven
Затронутые версииВерсия исправления
<= 1.6.0
1.6.1
Связанные уязвимости
CVSS3: 6.1
nvd
больше 4 лет назад
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.