CVE-2015-5318: CSRF
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.
Other sources
The following flaw was found in Jenkins:
The salt used to generate the CSRF protection tokens was a publicly accessible value, allowing malicious users to circumvent CSRF protection by generating the correct token.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5318?
CVE-2015-5318 is considered a moderate severity vulnerability due to the potential for bypassing CSRF protections.
How do I fix CVE-2015-5318?
To fix CVE-2015-5318, update Jenkins to version 1.638 or later, or LTS to version 1.625.2 or later.
Who is affected by CVE-2015-5318?
CVE-2015-5318 affects Jenkins versions prior to 1.638 and LTS versions prior to 1.625.2.
What kind of attack can exploit CVE-2015-5318?
CVE-2015-5318 can be exploited via a brute force attack to bypass the CSRF protection mechanism.
What does CVE-2015-5318 relate to in Jenkins?
CVE-2015-5318 relates to the use of a publicly accessible salt for generating CSRF protection tokens.