CVE-2015-5321: Infoleak
The following flaw was found in Jenkins:
The CLI command overview and help pages in Jenkins were accessible without Overall/Read permission, resulting in disclosure of the names of configured slaves (and contents of other sidepanel widgets, if present) to unauthorized users.
While the amount of information disclosed is very limited, it is trivial to exploit this flaw.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
Other sources
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5321?
CVE-2015-5321 has been classified as a medium severity vulnerability.
How do I fix CVE-2015-5321?
To fix CVE-2015-5321, update Jenkins to versions 1.638 or later and 1.625.2 or later for LTS.
What does CVE-2015-5321 affect?
CVE-2015-5321 affects Jenkins versions prior to 1.638 and LTS versions prior to 1.625.2.
What can attackers achieve with CVE-2015-5321?
Attackers can obtain sensitive information through direct requests to CLI command overview and help pages.
Is my version of Jenkins vulnerable to CVE-2015-5321?
If you are using Jenkins version earlier than 1.638 or LTS version earlier than 1.625.2, your version is vulnerable to CVE-2015-5321.