CVE-2015-5317highunder attackCWE-200

CVE-2015-5317

Published · Updated

Follow this CVE+ Monitor Jenkins User Interface+ Monitor org.jenkins-ci.main:jenkins-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.5epss 23%
from disclosure to weapon
Published on NVDNov 25
CISA KEV+2725d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
4 products (313 components)
Red Hat OpenShift Enterprise 3.1 · Red Hat OpenShift Enterprise Node 2.2 · Red Hat OpenShift Enterprise Infrastructure 2.2 · Red Hat OpenShift Enterprise Client 2.2
fix ↗
Action required by CISAfederal deadline: 2023-06-02

Apply updates per vendor instructions.

In short

Jenkins allows attackers to access sensitive job and build names through the Fingerprints pages without proper authentication, exposing information that should be private.

Technical detail

Improper access controls on the Fingerprints endpoint in Jenkins before 1.638 (LTS 1.625.2) enable unauthenticated information disclosure via direct HTTP requests, exposing job names, build identifiers, and related metadata to remote attackers.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a