| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:cas-plugin | < 1.6.1 | 1.6.1 |
| cas | ≤ 1.6.0 |
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.
Jenkins CAS Plugin 1.6.1 only redirects to relative (Jenkins) URLs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free