Information Exposure Affecting org.jenkins-ci.main:jenkins-core package, versions [,1.625.2) [1.630,1.638)
Threat Intelligence
EPSS
0.31% (71st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-32483
- published 27 Aug 2018
- disclosed 11 Nov 2015
- credit Akshay Dayal
Introduced: 11 Nov 2015
CVE-2015-5320 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to versions 1.625.2, 1.638 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open source automation server.
Affected versions of this package are vulnerable to Information Exposure. It did not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.
References
CVSS Scores
version 3.1