CVE-2016-3726

HIGH7.4EPSS 0.08%

Jenkins affected by Open Redirect Vulnerability

Published: 5/14/2022Modified: 3/13/2025

Description

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.

Affected packages (1)

Maven/org.jenkins-ci.main:jenkins-core>= 1.652, < 2.3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.4	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-3726
PATCHhttps://github.com/jenkinsci/jenkins
WEBhttp://rhn.redhat.com/errata/RHSA-2016-1773.html
WEBhttps://access.redhat.com/errata/RHSA-2016:1206
WEBhttps://github.com/jenkinsci/jenkins/commit/2ed0c046dfbb2003a17df27c53777e72c6eaff25
WEBhttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
WEBhttps://www.cloudbees.com/jenkins-security-advisory-2016-05-11