jenkinsci/jenkins · Security
Jenkins affected by Open Redirect Vulnerability
- GHSA ID
- GHSA-rx4r-gxpc-h85x
- CVE ID
- CVE-2016-3726
- Severity
- high
- Published
- Updated
- CVSS
- 7.4 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- CVSS v3
- 7.4 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Description
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.
CWEs
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3726 ↗
- https://access.redhat.com/errata/RHSA-2016:1206 ↗
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 ↗
- https://www.cloudbees.com/jenkins-security-advisory-2016-05-11 ↗
- http://rhn.redhat.com/errata/RHSA-2016-1773.html ↗
- https://github.com/jenkinsci/jenkins/commit/2ed0c046dfbb2003a17df27c53777e72c6eaff25 ↗
- https://github.com/advisories/GHSA-rx4r-gxpc-h85x ↗