GHSA-rx4r-gxpc-h85x
Jenkins affected by Open Redirect Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2016-3726
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Description
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 1.652, fixed 2.3 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 1.651.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3726 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/2ed0c046dfbb2003a17df27c53777e72c6eaff25 WEB
- https://access.redhat.com/errata/RHSA-2016:1206 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 WEB
- https://www.cloudbees.com/jenkins-security-advisory-2016-05-11 WEB
- http://rhn.redhat.com/errata/RHSA-2016-1773.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |