Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks.
Remediation
References
Related Vulnerabilities
SharePoint CVE-2017-0281 Vulnerability (CVE-2017-0281)
WordPress Plugin WordPress Books Gallery Security Bypass (3.5)
WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.25)
WordPress Plugin WP Inventory Manager Cross-Site Scripting (1.7.8)
WordPress Plugin VikBooking Hotel Booking Engine & PMS Multiple Vulnerabilities (1.5.7)