PT-2015-6856

CVE-2015-5323

Published

2015-11-25

Updated

2022-05-13

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.638 Jenkins LTS versions prior to 1.625.2

Description The issue allows remote administrators to potentially gain privileges and run scripts by using an API token of another user, due to improper access restrictions to API tokens.

Recommendations For Jenkins versions prior to 1.638, update to version 1.638 or later. For Jenkins LTS versions prior to 1.625.2, update to version 1.625.2 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-264

CWE-522: Insufficiently Protected Credentials

Related identifiers

CVE-2015-5323

GHSA-X4M5-J4X4-4WJG