CVE-2012-6073: Input Validation
Jenkins Security Advisory 2012-11-20
The second vulnerability is so-called open redirect vulnerability. This allows an anonymous attacker to create an URL that looks as if it's pointing to Jenkins, yet it actually lands on the site that the attacker controls. This can be therefore used as a basis for phishing.
Fix: Main line users should upgrade to Jenkins 1.491 LTS users should upgrade to 1.480.1
External URLs: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20 http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
Other sources
Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6073?
CVE-2012-6073 is classified as a medium severity open redirect vulnerability.
How do I fix CVE-2012-6073?
To fix CVE-2012-6073, update Jenkins to a version that addresses the open redirect issue.
Which versions of Jenkins are affected by CVE-2012-6073?
CVE-2012-6073 affects multiple versions of Jenkins including 1.400 through 1.466.2.
Can CVE-2012-6073 allow an attacker to redirect to malicious sites?
Yes, CVE-2012-6073 allows attackers to craft URLs that redirect users to potentially harmful sites.
Is there a workaround for CVE-2012-6073 if I cannot update Jenkins?
A recommended workaround for CVE-2012-6073 is to disable features in Jenkins that utilize URL redirection.