GitHub Advisoryadvisory · Maven

GHSA-2q8v-qx2x-hxjx Jenkins allows HTTP Injection and Response Splitting

MEDIUM Published 2022-05-14 Modified 2025-03-13 Official page ↗
Aliases
CVE-2012-6072
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-113, CWE-20
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.481, < 1.491 → fixed in 1.491 • Maven org.jenkins-ci.main:jenkins-core: < 1.480.1 → fixed in 1.480.1

Description

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2012-6072 CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x… vulnerability

Weakness · CWE (2)

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers weakness
  • CWE-20 Improper Input Validation weakness

References