CVEvulnerability

CVE-2015-7539

7.5 HIGH Published 2016-02-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-02-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.6 HIGH — AV:N/AC:H/Au:N/C:C/I:C/A:C
Weaknesses
CWE-345

Description

The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

Affected configurations

• jenkins jenkins (<= 1.639) • jenkins jenkins (<= 1.625.1) • redhat openshift 2.0 • redhat openshift 3.1

Related

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References