Description
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2016-1773.html
https://access.redhat.com/errata/RHSA-2016:1206
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
https://www.cloudbees.com/jenkins-security-advisory-2016-05-11
Related Vulnerabilities
CVE-2021-26544 Vulnerability in maven package org.apache.livy:livy-server
CVE-2023-49446 Vulnerability in maven package com.jfinal:jfinal
CVE-2017-1000397 Vulnerability in maven package org.jenkins-ci.main:maven-plugin
CVE-2023-50722 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui
CVE-2020-1942 Vulnerability in maven package org.apache.nifi:nifi-security-utils