CVE-2023-37947
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Jenkins OpenShift Login Plugin version 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines whether a redirect URL after login legitimately points to Jenkins, allowing attackers to perform phishing attacks.
Risk Assessment
Attackers can exploit this vulnerability to carry out effective phishing attacks, potentially leading to the theft of user login credentials.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this security flaw and implement additional phishing protection measures.
Original NVD description (English source)
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.