~ / search / GHSA-35gf-xjgf-96c5

GHSA-35gf-xjgf-96c5

Jenkins OpenShift Login Plugin vulnerable to Open Redirect

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-37947

Packages

EcosystemPackageAffectedFixed in
Maven org.openshift.jenkins:openshift-login < 1.1.0.230.v5d7030b 1.1.0.230.v5d7030b

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 only redirects to relative (Jenkins) URLs.

References

External links from the advisory. They lead to third-party sites.