medium6.9
CVE-2015-5321
Jenkins has Information Disclosure via Sidepanel Widget
Impact
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | >= 1.626, < 1.638 | 1.638 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Openshift | through 3.1 Version 2.0 |
| Jenkins | Jenkins | through 1.625.1 through 1.637 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://rhn.redhat.com/errata/RHSA-2016-0489.html
- https://access.redhat.com/errata/RHSA-2016:0070
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
- https://github.com/advisories/GHSA-4653-rmch-3g2g
- https://nvd.nist.gov/vuln/detail/CVE-2015-5321
- https://github.com/jenkinsci/jenkins/commit/251bdb00ab3cf4435416f0a55fa3bccf7f58896a
- https://github.com/jenkinsci/jenkins/commit/9e439d462c28fe1c96799c89709dc5d0cb8ab8fa