CVE-2023-24445 Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing…

Description

Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins openid Plugin 2.4	earliest → 2.4	No fix stated

Other CVEs of Jenkins openid Plugin

The 5 CVEs of Jenkins openid Plugin →

CVE-2023-24444 Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login 9.8 Critical CVE-2023-24446 A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick… 8.8 High CVE-2019-1003098 A cross-site request forgery vulnerability in Jenkins openid Plugin in the… Not rated CVE-2019-1003099 A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form… Not rated