CVE-2015-7538: CSRF
Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.
Other sources
Malicious users were able to circumvent CSRF protection on any URL by sending specially crafted POST requests. This could allow unprivileged attackers to circumvent CSRF protection.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7538?
CVE-2015-7538 has a medium severity rating due to its potential to allow unprivileged attackers to bypass CSRF protections.
How do I fix CVE-2015-7538?
To fix CVE-2015-7538, upgrade Jenkins to version 1.641 or later, or 1.625.3 or later for LTS releases.
What kind of attacks can exploit CVE-2015-7538?
CVE-2015-7538 can be exploited to perform unauthorized actions by sending specially crafted POST requests to Jenkins.
Which versions of Jenkins are affected by CVE-2015-7538?
CVE-2015-7538 affects Jenkins versions before 1.640 and LTS versions before 1.625.2.
Are there any specific products impacted by CVE-2015-7538?
Specific products impacted by CVE-2015-7538 include Jenkins and OpenShift Enterprise versions prior to 3.1.