CVE-2016-3723: Infoleak
Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.
Other sources
The following flaw was found in Jenkins:
The XML/JSON API endpoints providing information about installed plugins were missing permissions checks, allowing any user with read access to Jenkins to determine which plugins and versions were installed.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3723?
CVE-2016-3723 is considered a medium severity vulnerability due to its impact on sensitive information disclosure.
How do I fix CVE-2016-3723?
To fix CVE-2016-3723, upgrade Jenkins to version 2.3 or newer or LTS to version 1.651.2 or newer.
Who is affected by CVE-2016-3723?
CVE-2016-3723 affects Jenkins versions prior to 2.3 and LTS versions before 1.651.2.
What type of vulnerability is CVE-2016-3723?
CVE-2016-3723 is an information disclosure vulnerability that allows authenticated users to access sensitive plugin installation information.
Can CVE-2016-3723 be exploited remotely?
Yes, CVE-2016-3723 can be exploited remotely by authenticated users with read access to the Jenkins environment.