CVE-2021-21673
published 2021-06-30CVE-2021-21673: Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.58%
75.4th percentile
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | cas | <= 1.6.0 | — |
| jenkins | cas_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | selenium_html_report_plugin | — | — |
| jenkins_project | jenkins_cas_plugin | unspecified – 1.6.0 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Open redirect vulnerability in Jenkins CAS Plugin
ghsa·2022-05-24
CVE-2021-21673 [MEDIUM] CWE-601 Open redirect vulnerability in Jenkins CAS Plugin
Open redirect vulnerability in Jenkins CAS Plugin
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.
Jenkins CAS Plugin 1.6.1 only redirects to relative (Jenkins) URLs.
OSV
Open redirect vulnerability in Jenkins CAS Plugin
osv·2022-05-24
CVE-2021-21673 [MEDIUM] Open redirect vulnerability in Jenkins CAS Plugin
Open redirect vulnerability in Jenkins CAS Plugin
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.
Jenkins CAS Plugin 1.6.1 only redirects to relative (Jenkins) URLs.
Jenkins
Jenkins Security Advisory 2021-06-30
vendor_jenkins·2021-06-30·CVSS 4.3
CVE-2021-21670 [MEDIUM] Jenkins Security Advisory 2021-06-30
Title: Jenkins Security Advisory 2021-06-30
Jenkins Security Advisory 2021-06-30
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
CAS
Plugin
requests-plugin
Plugin
requests-plugin
Plugin
requests-plugin
Plugin
Selenium HTML report
Plugin
Descriptions
Improper permission checks allow
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-30
Published