CVE-2015-1812: XSS
An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23
Other sources
Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1812?
CVE-2015-1812 has been rated as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2015-1812?
To fix CVE-2015-1812, upgrade Jenkins to version 1.606 or later, or to version 1.596.2 for LTS.
What type of vulnerability is CVE-2015-1812?
CVE-2015-1812 is classified as a cross-site scripting (XSS) vulnerability.
Which versions of Jenkins are affected by CVE-2015-1812?
CVE-2015-1812 affects Jenkins versions prior to 1.606 and LTS versions prior to 1.596.2.
Can CVE-2015-1812 be exploited without user credentials?
Yes, CVE-2015-1812 can be exploited by attackers without any access to Jenkins.