GitHub Advisoryadvisory · Maven

GHSA-4653-rmch-3g2g Jenkins has Information Disclosure via Sidepanel Widget

MEDIUM Published 2022-05-13 Modified 2025-03-13 Official page ↗
Aliases
CVE-2015-5321
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.626, < 1.638 → fixed in 1.638 • Maven org.jenkins-ci.main:jenkins-core: < 1.625.2 → fixed in 1.625.2

Description

The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.

Related

Alias · CVE (1)

  • CVE-2015-5321 The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References