CVE-2015-5317
High · 7.5 CISA KEVCVSS
7.5
EPSS
23.0%
Published
Nov 25, 2015
CISA due date
Jun 2, 2023
The record
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 0 | 1.625.2 |
| Maven | org.jenkins-ci.main:jenkins-core | 1.626 | 1.638 |
| Red Hat:openshift:2.0::el6 | activemq | 0 | 0:5.9.0-6.redhat.611454.el6op |
| Red Hat:openshift:2.0::el6 | activemq-client | 0 | 0:5.9.0-6.redhat.611454.el6op |
| Red Hat:openshift:2.0::el6 | jenkins | 0 | 0:1.625.3-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-enterprise-release | 0 | 0:2.2.9-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-enterprise-upgrade | 0 | 0:2.2.9-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-enterprise-upgrade-broker | 0 | 0:2.2.9-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-enterprise-upgrade-node | 0 | 0:2.2.9-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-enterprise-yum-validator | 0 | 0:2.2.9-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-broker-util | 0 | 0:1.37.5.3-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-cartridge-cron | 0 | 0:1.25.2.1-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-cartridge-haproxy | 0 | 0:1.31.5.1-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-cartridge-mysql | 0 | 0:1.31.2.1-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-cartridge-php | 0 | 0:1.35.3.1-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-cartridge-python | 0 | 0:1.34.2.1-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-msg-node-mcollective | 0 | 0:1.30.2.1-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-node-proxy | 0 | 0:1.26.2.1-1.el6op |
| Red Hat:openshift:2.0::el6 | openshift-origin-node-util | 0 | 0:1.38.6.2-1.el6op |
| Red Hat:openshift:2.0::el6 | php | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-bcmath | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-debuginfo | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-devel | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-fpm | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-imap | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-intl | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-mbstring | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | php-process | 0 | 0:5.3.3-46.el6_7.1 |
| Red Hat:openshift:2.0::el6 | rhc | 0 | 0:1.38.6.1-1.el6op |
| Red Hat:openshift:2.0::el6 | rubygem-openshift-origin-common | 0 | 0:1.29.5.2-1.el6op |
| Red Hat:openshift:2.0::el6 | rubygem-openshift-origin-console | 0 | 0:1.35.5.1-1.el6op |
| Red Hat:openshift:2.0::el6 | rubygem-openshift-origin-controller | 0 | 0:1.38.5.1-1.el6op |
| Red Hat:openshift:2.0::el6 | rubygem-openshift-origin-frontend-apache-vhost | 0 | 0:0.13.2.1-1.el6op |
| Red Hat:openshift:2.0::el6 | rubygem-openshift-origin-node | 0 | 0:1.38.5.3-1.el6op |
| Red Hat:openshift:3.1::el7 | atomic-openshift | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-clients | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-clients-redistributable | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-dockerregistry | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-master | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-node | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-pod | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-recycle | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-sdn-ovs | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| Red Hat:openshift:3.1::el7 | atomic-openshift-utils | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | heapster | 0 | 0:0.18.2-3.gitaf4752e.el7aos |
| Red Hat:openshift:3.1::el7 | jenkins | 0 | 0:1.625.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-align-text | 0 | 0:0.1.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ansi-green | 0 | 0:0.1.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ansi-wrap | 0 | 0:0.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-anymatch | 0 | 0:1.3.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-arr-diff | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-arr-flatten | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-array-unique | 0 | 0:0.2.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-arrify | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-async-each | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-binary-extensions | 0 | 0:1.3.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-braces | 0 | 0:1.8.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-capture-stack-trace | 0 | 0:1.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-chokidar | 0 | 0:1.4.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-configstore | 0 | 0:1.4.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-create-error-class | 0 | 0:2.0.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-deep-extend | 0 | 0:0.3.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-duplexer | 0 | 0:0.1.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-duplexify | 0 | 0:3.4.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-end-of-stream | 0 | 0:1.1.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-error-ex | 0 | 0:1.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-es6-promise | 0 | 0:3.0.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-event-stream | 0 | 0:3.3.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-expand-brackets | 0 | 0:0.1.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-expand-range | 0 | 0:1.8.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-extglob | 0 | 0:0.3.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-filename-regex | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-fill-range | 0 | 0:2.2.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-for-in | 0 | 0:0.1.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-for-own | 0 | 0:0.1.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-from | 0 | 0:0.1.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-glob-base | 0 | 0:0.3.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-glob-parent | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-got | 0 | 0:5.2.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-graceful-fs | 0 | 0:4.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ini | 0 | 0:1.1.0-6.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-binary-path | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-dotfile | 0 | 0:1.0.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-equal-shallow | 0 | 0:0.1.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-extendable | 0 | 0:0.1.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-extglob | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-glob | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-npm | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-number | 0 | 0:2.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-plain-obj | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-primitive | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-redirect | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-is-stream | 0 | 0:1.0.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-isobject | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-kind-of | 0 | 0:3.0.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-latest-version | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lazy-cache | 0 | 0:1.0.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.assign | 0 | 0:3.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.baseassign | 0 | 0:3.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.basecopy | 0 | 0:3.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.bindcallback | 0 | 0:3.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.createassigner | 0 | 0:3.1.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.defaults | 0 | 0:3.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.getnative | 0 | 0:3.9.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.isarguments | 0 | 0:3.0.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.isarray | 0 | 0:3.0.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.isiterateecall | 0 | 0:3.0.9-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.keys | 0 | 0:3.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lodash.restparam | 0 | 0:3.6.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-lowercase-keys | 0 | 0:1.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-map-stream | 0 | 0:0.1.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-micromatch | 0 | 0:2.3.5-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-mkdirp | 0 | 0:0.5.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-node-status-codes | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-nodemon | 0 | 0:1.8.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-normalize-path | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-object-assign | 0 | 0:4.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-object.omit | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-optimist | 0 | 0:0.4.0-5.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-os-homedir | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-os-tmpdir | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-osenv | 0 | 0:0.1.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-package-json | 0 | 0:2.3.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-parse-glob | 0 | 0:3.0.4-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-parse-json | 0 | 0:2.2.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-pause-stream | 0 | 0:0.0.11-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-pinkie | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-pinkie-promise | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-prepend-http | 0 | 0:1.0.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-preserve | 0 | 0:0.2.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-ps-tree | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-randomatic | 0 | 0:1.1.5-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-rc | 0 | 0:1.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-read-all-stream | 0 | 0:3.0.1-3.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-readdirp | 0 | 0:2.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-regex-cache | 0 | 0:0.4.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-registry-url | 0 | 0:3.0.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-repeat-element | 0 | 0:1.1.2-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-semver | 0 | 0:5.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-semver-diff | 0 | 0:2.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-slide | 0 | 0:1.1.5-3.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-split | 0 | 0:0.3.3-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-stream-combiner | 0 | 0:0.2.1-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-string-length | 0 | 0:1.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-strip-json-comments | 0 | 0:1.0.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-success-symbol | 0 | 0:0.1.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-through | 0 | 0:2.3.4-4.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-timed-out | 0 | 0:2.0.0-3.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-touch | 0 | 0:1.0.0-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-undefsafe | 0 | 0:0.0.3-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-unzip-response | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-update-notifier | 0 | 0:0.6.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-url-parse-lax | 0 | 0:1.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-uuid | 0 | 0:2.0.1-1.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-write-file-atomic | 0 | 0:1.1.2-2.el7aos |
| Red Hat:openshift:3.1::el7 | nodejs-xdg-basedir | 0 | 0:2.0.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | nss_wrapper | 0 | 0:1.0.3-1.el7 |
| Red Hat:openshift:3.1::el7 | nss_wrapper-debuginfo | 0 | 0:1.0.3-1.el7 |
| Red Hat:openshift:3.1::el7 | openshift-ansible | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-docs | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-filter-plugins | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-lookup-plugins | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-playbooks | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openshift-ansible-roles | 0 | 0:3.0.35-1.git.0.6a386dd.el7aos |
| Red Hat:openshift:3.1::el7 | openvswitch | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | openvswitch-debuginfo | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | openvswitch-devel | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | openvswitch-test | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | origin-kibana | 0 | 0:0.5.0-1.el7aos |
| Red Hat:openshift:3.1::el7 | python-openvswitch | 0 | 0:2.4.0-1.el7 |
| Red Hat:openshift:3.1::el7 | tuned-profiles-atomic-openshift-node | 0 | 0:3.1.1.6-1.git.0.b57e8bd.el7aos |
| maven | org.jenkins-ci.main/jenkins-core | 1.626 | 1.638 |
Related vulnerabilities
- GHSA-85h6-5m3v-gx37 Jenkins has a stored XSS vulnerability in node offline cause description Also affects org.jenkins-ci.main:jenkins-core
- GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter Also affects org.jenkins-ci.main:jenkins-core
- CVE-2026-27099 Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both… Also affects org.jenkins-ci.main:jenkins-core
- CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that… Also affects org.jenkins-ci.main:jenkins-core
- GHSA-6837-qgrc-x5p6 Jenkins has a CSRF vulnerability on the login form Also affects org.jenkins-ci.main:jenkins-core
- GHSA-9p56-p6mw-w8qc Jenkins has a Denial of service vulnerability in HTTP-based CLI Also affects org.jenkins-ci.main:jenkins-core
- GHSA-fxj7-6v9w-xc76 Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core
- GHSA-hxjg-2jvf-h3rx Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core