4.3
Moyenne
CVE-2026-53437 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately…
Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jenkins 2.568 | premières → < 2.568 | 2.568 |
| Jenkins 2.555 | premières → < 2.555.3 | 2.555.3 |
| OpenShift Developer Tools and Services | Versions non publiées | |
| OpenShift Developer Tools and Services 4.12 1786628667 | premières → < 1786628667 | 1786628667 |
| OpenShift Developer Tools and Services 4.13 1786628681 | premières → < 1786628681 | 1786628681 |
| OpenShift Developer Tools and Services 4.14 1786533561 | premières → < 1786533561 | 1786533561 |
| OpenShift Developer Tools and Services 4.15 1786533565 | premières → < 1786533565 | 1786533565 |
| OpenShift Developer Tools and Services 4.16 1787125166 | premières → < 1787125166 | 1787125166 |
| OpenShift Developer Tools and Services 4.17 1787124635 | premières → < 1787124635 | 1787124635 |
Afficher les 5 autres branches Masquer les 5 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenShift Developer Tools and Services 4.18 1787125069 | premières → < 1787125069 | 1787125069 |
| OpenShift Developer Tools and Services 4.19 1787124632 | premières → < 1787124632 | 1787124632 |
| OpenShift Developer Tools and Services 4.20 1787124925 | premières → < 1787124925 | 1787124925 |
| OpenShift Developer Tools and Services 4.21 1787125311 | premières → < 1787125311 | 1787125311 |
| OpenShift Developer Tools and Services 4.22 1787124779 | premières → < 1787124779 | 1787124779 |
Références
- Jenkins Security Advisory 2026-06-10 www.jenkins.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Jenkins
Les 153 CVE de Jenkins →
CVE-2026-117626
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the…
4.3
Moyenne
CVE-2026-117624
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing…
8.8
Élevée
CVE-2026-117625
A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read…
4.3
Moyenne
CVE-2026-117623
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar…
5.4
Moyenne