CVE-2015-5317
Last modified
CVE-2015-5317 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.. CISA has confirmed active exploitation in the wild. EPSS estimates a 22.43% chance of exploitation in the next 30 days.
Description
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Jenkins | <= 1.637 |
| Jenkins | Jenkins | <= 1.625.1 |
| Redhat | Openshift | 2.0 |
| Redhat | Openshift | <= 3.1 |
References
- http://rhn.redhat.com/errata/RHSA-2016-0489.htmlThird Party Advisory
- https://access.redhat.com/errata/RHSA-2016:0070Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0489.htmlThird Party Advisory
- https://access.redhat.com/errata/RHSA-2016:0070Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5317US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2015-5317?
How severe is CVE-2015-5317?
How do I fix CVE-2015-5317?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-5311PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 …
- CVE-2015-5312The xmlStringLenDecodeEntities function in parser.c in libxm…
- CVE-2015-5313Directory traversal vulnerability in the virStorageBackendFi…
- CVE-2015-5314The eap_pwd_process function in eap_server/eap_server_pwd.c …
- CVE-2015-5315The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_su…
- CVE-2015-5316The eap_pwd_perform_confirm_exchange function in eap_peer/ea…
- CVE-2015-5318Jenkins before 1.638 and LTS before 1.625.2 uses a publicly …
- CVE-2015-5319XML external entity (XXE) vulnerability in the create-job CL…
- CVE-2015-5320Jenkins before 1.638 and LTS before 1.625.2 do not properly …
- CVE-2015-5321The sidepanel widgets in the CLI command overview and help p…
- CVE-2015-5322Directory traversal vulnerability in Jenkins before 1.638 an…
- CVE-2015-5323Jenkins before 1.638 and LTS before 1.625.2 do not properly …
Are you affected by CVE-2015-5317?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST