I
n Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3501 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Jun 2025, 00:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* |
|
| First Time |
Jenkins
Jenkins jenkins |
|
| References | () https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3501 - Vendor Advisory |
06 Mar 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-05 23:15
Updated : 2025-06-24 00:42
NVD link : CVE-2025-27625
Mitre link : CVE-2025-27625
CVE.ORG link : CVE-2025-27625
JSON object : View
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')