CVE-2015-5324: Infoleak
Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.
Other sources
The following flaw was found in Jenkins:
The /queue/api URL could return information about items not accessible to the current user (such as parameter names and values, build names, project descriptions, ...).
Low privileged users can gain some limited information about items they should not have access to.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5324?
CVE-2015-5324 is classified as a medium severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2015-5324?
To fix CVE-2015-5324, update Jenkins to version 1.638 or later, or to version 1.625.2 for LTS installations.
Who is affected by CVE-2015-5324?
CVE-2015-5324 affects Jenkins versions prior to 1.638 and Jenkins LTS versions prior to 1.625.2.
What type of vulnerability is CVE-2015-5324?
CVE-2015-5324 is a sensitive information disclosure vulnerability that allows unauthorized access to certain Jenkins API data.
Can CVE-2015-5324 be exploited remotely?
Yes, CVE-2015-5324 can be exploited remotely by attackers who can make direct requests to the Jenkins queue API.