IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.5Yüksek KEV

CVE-2015-5317Jenkins User Interface (UI) Information Disclosure Vulnerability

jenkins jenkins; redhat openshift Yayım: (10 yıl önce)

Aktif olarak istismar ediliyor — Jenkins User Interface (UI) Information Disclosure Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 12.05.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 02.06.2023.

Gerekli işlem: Apply updates per vendor instructions. https://www.jenkins.io/security/advisory/2015-11-11/; https://nvd.nist.gov/vuln/detail/CVE-2015-5317

Açıklama

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

Zayıflık türü (CWE): CWE-200

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
jenkins jenkins ≤ 1.637
redhat openshift 2.0

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (4)
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* ≤ 1.637
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* ≤ 1.625.1
  • cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:* ≤ 3.1

Aynı üründe son açıklar — Jenkins (core)

Puansız
CVE-2026-117626
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and la…

8.8Yüksek
CVE-2026-117624
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypas…

Puansız
CVE-2026-117625
Jenkins Project Jenkins

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

5.4Orta
CVE-2026-117623
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

6.1Orta
CVE-2026-117621
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

6.1Orta
CVE-2026-117622
Jenkins Project Jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.