CVE-2023-37947

2023-07-1216:15:13

CWE-601

[email protected]

web.nvd.nist.gov

cve

jenkins

openshift

security vulnerability

phishing attack

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

19.7%

JSON

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

Affected configurations

NVD

Node

jenkinsopenshift_loginRange<1.1.0.230.v5d7030b_f5432jenkins

CPENameOperatorVersion
jenkins:openshift_loginjenkins openshift loginlt1.1.0.230.v5d7030b_f5432

CPE	Name	Operator	Version
jenkins:openshift_login	jenkins openshift login	lt	1.1.0.230.v5d7030b_f5432

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins OpenShift Login Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.1.0.227.v27e08dfb_1a_20",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]