Actively exploited · Published Nov 25, 2015 · Assigned by redhat

CVE-2015-5317

High 7.5 Exploited

In plain English

A high-severity information exposure in Jenkins User Interface (UI) from Jenkins. Attackers are actively exploiting it in the wild (listed by CISA on May 12, 2023). The chance it is exploited in the next 30 days is estimated at 23.0% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)23.0%top 2.2% of all CVEs

Exploited in the wildYesCISA KEV since May 12, 2023

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 2, 2023.

Official description

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jenkins-ci.main:jenkins-core	1.625.2	GHSA-8pqx-3rxx-f5pm
Maven	org.jenkins-ci.main:jenkins-core	1.638	GHSA-8pqx-3rxx-f5pm

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

RHSA-2016:0489 vendor-advisory, x_refsource_REDHAT
RHSA-2016:0070 vendor-advisory, x_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5317 government-resource