Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkins2Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | May 12, 2016 |
| Jenkins 2016 05 11 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 1.651.2Upgrade Jenkins to version 2.3Upgrade Jenkins to the latest version | Nov 13, 2017 | May 17, 2016 |
| Redhat Openshift | — | Upgrade openshift-origin-node-proxyUpgrade openshift-origin-cartridge-jbosseapUpgrade openshift-origin-cartridge-cronUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade activemqUpgrade openshift-origin-cartridge-pythonUpgrade openshift-origin-cartridge-perlUpgrade openshift-origin-cartridge-phpUpgrade openshift-origin-cartridge-jbossewsUpgrade openshift-origin-cartridge-jenkins-clientUpgrade rhcUpgrade ImageMagickUpgrade libcgroupUpgrade rubygem-openshift-origin-admin-consoleUpgrade jenkins-plugin-openshift-pipelineUpgrade openshift-origin-cartridge-nodejsUpgrade rubygem-openshift-origin-controllerUpgrade openshift-origin-cartridge-rubyUpgrade rubygem-openshift-origin-nodeUpgrade openshift-origin-node-utilUpgrade openshift-origin-cartridge-jenkinsUpgrade openshift-origin-cartridge-mongodbUpgrade openshift-origin-broker-utilUpgrade rubygem-openshift-origin-routing-daemonUpgrade jenkinsUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade openshift-origin-cartridge-haproxyUpgrade openshift-origin-cartridge-diyUpgrade openshift-origin-brokerUpgrade openshift-origin-cartridge-mysqlUpgrade openshift-origin-msg-node-mcollective | Jun 18, 2018 | May 11, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub