Cas (Jenkins) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 14 known versions, newest CVE from 2024-05-23. Vendor: Jenkins.

CVEs of Cas

• CVE-2024-4388 - CVSS 7.5 (high), 2024-05-23: This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server
• CVE-2024-4399 - CVSS 9.1 (critical), 2024-05-23: The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
• CVE-2023-32997 - CVSS 8.8 (high), 2023-05-16: Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.
• CVE-2021-21673 - CVSS 6.1 (medium), 2021-06-30: Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform…
• CVE-2018-1000188 - CVSS 5.4 (medium), 2018-06-05: A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read…