CVE-2015-5319
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
25/11/2015
Last modified:
12/04/2025
Description
XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.
Impact
Base Score 2.0
5.00
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:* | 3.1 (including) | |
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* | 1.625.1 (including) | |
cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* | 1.637 (including) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://rhn.redhat.com/errata/RHSA-2016-0489.html
- https://access.redhat.com/errata/RHSA-2016:0070
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
- http://rhn.redhat.com/errata/RHSA-2016-0489.html
- https://access.redhat.com/errata/RHSA-2016:0070
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11