CVE-2016-3722: Medium severity jenkins lts vulnerability
Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."
Other sources
The following flaw was found in Jenkins:
By changing the freely editable 'full name', malicious users with multiple user accounts could prevent other users from logging in, as 'full name' was resolved before actual user name to determine which account is currently trying to log in.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3722?
CVE-2016-3722 is categorized as a denial of service vulnerability.
How do I fix CVE-2016-3722?
To fix CVE-2016-3722, upgrade Jenkins to version 2.3 or later, or to version 1.651.2 or later.
Who is affected by CVE-2016-3722?
CVE-2016-3722 affects Jenkins versions before 2.3 and LTS versions before 1.651.2.
What type of users can exploit CVE-2016-3722?
Remote authenticated users with multiple accounts can exploit CVE-2016-3722 to cause a denial of service.
What happens if CVE-2016-3722 is exploited?
Exploitation of CVE-2016-3722 can lead to users being unable to log in to their accounts.