Description
Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
Remediation
References
https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2967
Related Vulnerabilities
CVE-2020-27216 Vulnerability in maven package org.mortbay.jetty:jetty
CVE-2023-46731 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui
CVE-2015-5351 Vulnerability in maven package org.apache.tomcat:tomcat
CVE-2023-42795 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2023-4853 Vulnerability in maven package io.quarkus:quarkus-vertx-http