CVE-2016-3726

HIGH7.4EPSS 0.08%

Jenkins affected by Open Redirect Vulnerability

發布日:2022/5/14修改日:2025/3/13

描述

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.

受影響套件(1)

Maven/org.jenkins-ci.main:jenkins-core>= 1.652, < 2.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.4	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-3726
PATCHhttps://github.com/jenkinsci/jenkins
WEBhttp://rhn.redhat.com/errata/RHSA-2016-1773.html
WEBhttps://access.redhat.com/errata/RHSA-2016:1206
WEBhttps://github.com/jenkinsci/jenkins/commit/2ed0c046dfbb2003a17df27c53777e72c6eaff25
WEBhttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
WEBhttps://www.cloudbees.com/jenkins-security-advisory-2016-05-11