GHSA-6cr3-cm5h-8q96

Jenkins Exposes Sensitive Information via API URL

At a glance

Published: 2022-05-14 03:57 UTC
Updated: 2025-03-13 18:40 UTC
CVE: CVE-2016-3727
CVSS_V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.652, fixed 2.3
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.651.2

References

https://nvd.nist.gov/vuln/detail/CVE-2016-3727 ADVISORY
https://github.com/jenkinsci/jenkins/commit/d66ad6f3ee46a5c6bb865bb831e8cdfc74cd7eb3 WEB
https://access.redhat.com/errata/RHSA-2016:1206 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 WEB
https://www.cloudbees.com/jenkins-security-advisory-2016-05-11 WEB
http://rhn.redhat.com/errata/RHSA-2016-1773.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database