IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High KEV

CVE-2015-5317Jenkins User Interface (UI) Information Disclosure Vulnerability

jenkins jenkins; redhat openshift Published: (10 years ago)

Known exploited — Jenkins User Interface (UI) Information Disclosure Vulnerability

CISA confirmed this vulnerability is used in real attacks on 12.05.2023. Remediation deadline for US federal agencies: 02.06.2023.

Required action: Apply updates per vendor instructions. https://www.jenkins.io/security/advisory/2015-11-11/; https://nvd.nist.gov/vuln/detail/CVE-2015-5317

Description

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

Weakness (CWE): CWE-200

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
jenkins jenkins ≤ 1.637
redhat openshift 2.0

References and patches

CPE matches (NVD) (4)
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* ≤ 1.637
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* ≤ 1.625.1
  • cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:* ≤ 3.1

Recent CVEs in the same product — Jenkins (core)

4.3Medium
CVE-2026-117626
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and la…

8.8High
CVE-2026-117624
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypas…

4.3Medium
CVE-2026-117625
Jenkins Project Jenkins

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

5.4Medium
CVE-2026-117623
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

6.1Medium
CVE-2026-117621
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

6.1Medium
CVE-2026-117622
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.