CVE-2016-3724: Infoleak
Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.
Other sources
The following flaw was found in Jenkins:
Users with extended read access could access encrypted secrets stored directly in the configuration of those items.
As a side-effect of this change, copying a job that contains secrets in its configuration now requires the Configure permission on that job.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3724?
CVE-2016-3724 is classified as a medium severity vulnerability.
How do I fix CVE-2016-3724?
To fix CVE-2016-3724, upgrade Jenkins to version 2.3 or later, or 1.651.2 or later for LTS users.
Who is affected by CVE-2016-3724?
CVE-2016-3724 affects remote authenticated users with extended read access in Jenkins versions prior to 2.3 and 1.651.2.
What type of information can be accessed due to CVE-2016-3724?
Due to CVE-2016-3724, sensitive password information can be accessed by reading a job configuration.
Which versions of Jenkins are vulnerable to CVE-2016-3724?
Versions of Jenkins prior to 2.3 and LTS versions prior to 1.651.2 are vulnerable to CVE-2016-3724.