Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
Remediation
References
Related Vulnerabilities
SharePoint CVE-2024-49062 Vulnerability (CVE-2024-49062)
WordPress Plugin SendinBlue Subscribe Form And WP SMTP Multiple Unspecified Vulnerabilities (2.7.3)
WordPress Plugin Church Admin Cross-Site Scripting (0.800)
WordPress Plugin Contact Form 7 Arbitrary File Upload (3.5.3)
MySQL Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1626)