| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:bitbucket-oauth | < 0.18 | 0.18 |
| bitbucket oauth | ≤ 0.17 |
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login.
This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.
Bitbucket OAuth Plugin 0.18 only redirects to relative (Jenkins) URLs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free