Phishing Vulnerability in Jenkins CAS Plugin by Jenkins

CVE-2021-21673

Summary

The Jenkins CAS Plugin up to version 1.6.0 contains a vulnerability that fails to correctly validate redirect URLs following user login. This flaw allows attackers to manipulate the system into believing that a malicious redirect URL is legitimate, subsequently directing unsuspecting users to phishing sites. As a result, user credentials and sensitive data may be compromised. It is crucial for users to update to the latest version of the plugin to mitigate this risk and protect against potential phishing attacks.

References