IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta KEV

CVE-2015-5317Jenkins User Interface (UI) Information Disclosure Vulnerability

jenkins jenkins; redhat openshift Publicada: (hace 10 años)

Explotación conocida — Jenkins User Interface (UI) Information Disclosure Vulnerability

CISA confirmó el 12.05.2023 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 02.06.2023.

Acción requerida: Apply updates per vendor instructions. https://www.jenkins.io/security/advisory/2015-11-11/; https://nvd.nist.gov/vuln/detail/CVE-2015-5317

Descripción

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

Debilidad (CWE): CWE-200

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
jenkins jenkins ≤ 1.637
redhat openshift 2.0

Referencias y parches

Coincidencias CPE (NVD) (4)
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* ≤ 1.637
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* ≤ 1.625.1
  • cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:* ≤ 3.1

CVE recientes del mismo producto — Jenkins (core)

Sin puntuación
CVE-2026-117626
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and la…

8.8Alta
CVE-2026-117624
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypas…

Sin puntuación
CVE-2026-117625
Jenkins Project Jenkins

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

5.4Media
CVE-2026-117623
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

6.1Media
CVE-2026-117621
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

6.1Media
CVE-2026-117622
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.