Lucene search

GitHub Advisory DatabaseGHSA-9QV8-7JFQ-73J2

HistoryDec 13, 2023 - 6:31 p.m.

Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin

2023-12-1318:31:04

CWE-601

GitHub Advisory Database

github.com

jenkins

openid connect

authentication

plugin

vulnerability

redirect

url

phishing

attack

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

Affected configurations

Vulners

Node

trestleauthRange≤2.6

CPENameOperatorVersion
org.jenkins-ci.plugins:oic-authle2.6

CPE	Name	Operator	Version
	org.jenkins-ci.plugins:oic-auth	le	2.6

References

www.openwall.com/lists/oss-security/2023/12/13/4

github.com/advisories/GHSA-9qv8-7jfq-73j2

nvd.nist.gov/vuln/detail/CVE-2023-50771

www.jenkins.io/security/advisory/2023-12-13/#SECURITY-2979

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for GHSA-9QV8-7JFQ-73J2