CVE-2016-3725: Medium severity jenkins lts vulnerability
Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).
Other sources
The following flaw was found in Jenkins:
A missing permissions check allowed any user with access to Jenkins to trigger an update of update site metadata. This could be combined with DNS cache poisoning to disrupt Jenkins service.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3725?
CVE-2016-3725 is classified as a medium severity vulnerability that allows remote authenticated users to disrupt service.
How do I fix CVE-2016-3725?
To fix CVE-2016-3725, upgrade Jenkins to version 2.3 or later, or to LTS version 1.651.2 or later.
Who is affected by CVE-2016-3725?
CVE-2016-3725 affects Jenkins versions before 2.3 and LTS versions before 1.651.2.
Can CVE-2016-3725 be exploited remotely?
Yes, CVE-2016-3725 can be exploited remotely by authenticated users to update update site metadata.
What are the potential consequences of CVE-2016-3725?
Exploitation of CVE-2016-3725 can lead to service disruption when combined with DNS cache poisoning.