Jenkins affected by Open Redirect Vulnerability

published 2013-02-24 13 y ago modified 2026-06-16 4 mo ago also GHSA-mqgf-4rw4-2cq2 , EUVD-2012-5947

cvss: 5.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Patch / fix

fixed in 1 distros 1

maven org.jenkins-ci.main:jenkins-core 1.480.1, 1.491

rhc openshift 1 1.3.2-1.3.el6op
jenkins openshift 1 1.498-1.1.el6op
mongodb openshift 1 2.0.2-6.el6op
libmongodb openshift 1 2.0.2-6.el6op
mongodb-server openshift 1 2.0.2-6.el6op
openshift-console openshift 1 0.0.13-2.el6op
rubygem-activerecord openshift 1 1:3.0.13-3.el6op
ruby193-mod_passenger openshift 1 3.0.12-21.el6op

red hat advisories RHSA-2013:0220

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-6073 updated 2026-06-27 cvss 4.3

Jenkins: open redirect

Red Hat OpenShift Enterprise Client Tools rhc 1.3.2-1.3.el6op Red Hat OpenShift Enterprise Infrastructure mongodb 2.0.2-6.el6op, libmongodb 2.0.2-6.el6op, mongodb-server 2.0.2-6.el6op, openshift-console 0.0.13-2.el6op, rubygem-activerecord 3.0.13-3.el6op, ruby193-mod_passenger 3.0.12-21.el6op, +12 more Red Hat OpenShift Enterprise Node jenkins 1.498-1.1.el6op, ruby193-mod_passenger 3.0.12-21.el6op, openshift-origin-node-util 1.0.7-1.el6op, ruby193-rubygem-activerecord 3.2.8-2.el6, openshift-origin-port-proxy 1.0.3-1.el6op, ruby193-rubygem-passenger 3.0.12-21.el6op, +8 more
fixed: vendor fix RHSA-2013:0220

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.82% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.main:jenkins-core	<1.480.1 >=1.481, <1.491	1.480.1 1.491

Classification

Weakness

CWE-20 Improper Input Validation
CWE-601 URL Redirection to Untrusted Site

Technology feeds

Jenkins rss critical rss

References

rhn.redhat.com /errata/RHSA-2013-0220.html
vendor-advisory, web
cloudbees.com /jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
web, vendor-advisory
openwall.com /lists/oss-security/2012/12/28/1
mailing-list, web
wiki.jenkins-ci.org /display/SECURITY/Jenkins+Security+Advisory+2012-11-20
web
bugzilla.redhat.com /show_bug.cgi?id=890608
web
nvd.nist.gov /vuln/detail/CVE-2012-6073
advisory
github.com /jenkinsci/jenkins
package

Sources

CVE List CVE-2012-6073
GitHub Advisory GHSA-mqgf-4rw4-2cq2
NVD CVE-2012-6073

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary