Jenkins Google Login Plugin Open Redirect vulnerability

2022-05-1403:18:40

Google

osv.dev

0.001 Low

EPSS

Percentile

32.9%

JSON

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Google Login Plugin 1.3.1 only performs redirects to relative URLs.

CPENameOperatorVersion
org.jenkins-ci.plugins:google-logineq1.1
org.jenkins-ci.plugins:google-logineq1.0
org.jenkins-ci.plugins:google-logineq1.3
org.jenkins-ci.plugins:google-logineq1.2.1
org.jenkins-ci.plugins:google-logineq1.2

Name	Operator	Version
org.jenkins-ci.plugins:google-login	eq	1.1
org.jenkins-ci.plugins:google-login	eq	1.0
org.jenkins-ci.plugins:google-login	eq	1.3
org.jenkins-ci.plugins:google-login	eq	1.2.1
org.jenkins-ci.plugins:google-login	eq	1.2