Loading product vulnerabilities…
Total
3
Critical
0
High
1
Medium
1
CISA KEV
0
Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.