In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (\) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects.
{
"versions": [
{
"introduced": "0"
},
{
"fixed": "2.492.2"
},
{
"introduced": "0"
},
{
"fixed": "2.500"
}
]
}