PT-2023-26194 · Jenkins · Jenkins Openshift Login Plugin+1

Kevin Guerroudj + 1 · Publicado 2023-07-12 · Atualizado 2023-07-20 · CVE-2023-37947

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins OpenShift Login Plugin versions 1.1.0.227.v27e08dfb 1a 20 and earlier

Description The issue improperly determines the legitimacy of a redirect URL after login, allowing attackers to perform phishing attacks. This is achieved by having users visit a Jenkins URL that forwards them to a different site after successful authentication.

Recommendations For Jenkins OpenShift Login Plugin versions 1.1.0.227.v27e08dfb 1a 20 and earlier, update to version 1.1.0.230.v5d7030b f5432 or later, which only redirects to relative Jenkins URLs, mitigating the phishing attack risk.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2023-37947

GHSA-35GF-XJGF-96C5

RHSA-2024:0777

RHSA-2024:0778

Produtos afetados

Jenkins

Jenkins Openshift Login Plugin

Referências · 5

• https://osv.dev/vulnerability/GHSA-35gf-xjgf-96c5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37947 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37947 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-07-12/#SECURITY-2999 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/07/12/2 · Nota