What is the severity of CVE-2015-5320?

CVE-2015-5320 is classified as a critical vulnerability due to its potential to allow unauthorized remote access and administrative privileges.

How do I fix CVE-2015-5320?

To mitigate CVE-2015-5320, upgrade Jenkins to version 1.638 or later, or LTS to version 1.625.2 or later.

What versions of Jenkins are affected by CVE-2015-5320?

Jenkins versions prior to 1.638 and LTS versions prior to 1.625.2 are affected by CVE-2015-5320.

Can CVE-2015-5320 allow attackers to compromise sensitive data?

Yes, CVE-2015-5320 could allow remote attackers to connect as slaves and gain access to sensitive information.

Is CVE-2015-5320 specific only to Jenkins?

CVE-2015-5320 primarily affects Jenkins, but it may also impact OpenShift versions that include Jenkins versions prior to the fixed releases.

Vulnerability/
CVE-2015-5320

medium

CWE

200

16/11/2015

25/11/2015

6/8/2024

CVE-2015-5320: Infoleak

First published: Mon Nov 16 2015(Updated: )

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
redhat/Jenkins	<1.638	1.638
redhat/Jenkins	<1.625.2	1.625.2
redhat openshift	<=3.1
Jenkins Jenkins	<=1.637
Jenkins Jenkins	<=1.625.1
redhat openshift	=2.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2015-5320?
CVE-2015-5320 is classified as a critical vulnerability due to its potential to allow unauthorized remote access and administrative privileges.
How do I fix CVE-2015-5320?
To mitigate CVE-2015-5320, upgrade Jenkins to version 1.638 or later, or LTS to version 1.625.2 or later.
What versions of Jenkins are affected by CVE-2015-5320?
Jenkins versions prior to 1.638 and LTS versions prior to 1.625.2 are affected by CVE-2015-5320.
Can CVE-2015-5320 allow attackers to compromise sensitive data?
Yes, CVE-2015-5320 could allow remote attackers to connect as slaves and gain access to sensitive information.
Is CVE-2015-5320 specific only to Jenkins?
CVE-2015-5320 primarily affects Jenkins, but it may also impact OpenShift versions that include Jenkins versions prior to the fixed releases.

agent/type
agent/first-publish-date
agent/references
agent/weakness
agent/author
agent/severity
agent/description
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2015-5320
agent/software-canonical-lookup
collector/nvd-index
agent/software-canonical-lookup-request
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/tags
agent/event
agent/source
package-manager/redhat
vendor/redhat
canonical/redhat openshift
version/redhat openshift/3.1
vendor/jenkins
canonical/jenkins jenkins
version/jenkins jenkins/1.637
version/jenkins jenkins/1.625.1
version/redhat openshift/2.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2015-5320?
CVE-2015-5320 is classified as a critical vulnerability due to its potential to allow unauthorized remote access and administrative privileges.
How do I fix CVE-2015-5320?
To mitigate CVE-2015-5320, upgrade Jenkins to version 1.638 or later, or LTS to version 1.625.2 or later.
What versions of Jenkins are affected by CVE-2015-5320?
Jenkins versions prior to 1.638 and LTS versions prior to 1.625.2 are affected by CVE-2015-5320.
Can CVE-2015-5320 allow attackers to compromise sensitive data?
Yes, CVE-2015-5320 could allow remote attackers to connect as slaves and gain access to sensitive information.
Is CVE-2015-5320 specific only to Jenkins?
CVE-2015-5320 primarily affects Jenkins, but it may also impact OpenShift versions that include Jenkins versions prior to the fixed releases.