Jenkins Project Jenkins CAS Plugin

• CVE-2023-32997 High 8.8 Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login. 0.8%
• CVE-2021-21673 Unrated Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks. 1.6%