~ / search / GHSA-2vvr-5757-qp87

GHSA-2vvr-5757-qp87

Open redirect vulnerability in Jenkins CAS Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21673

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:cas-plugin < 1.6.1 1.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. Jenkins CAS Plugin 1.6.1 only redirects to relative (Jenkins) URLs.

References

External links from the advisory. They lead to third-party sites.