GitHub Advisoryadvisory · Maven

GHSA-6cr3-cm5h-8q96 Jenkins Exposes Sensitive Information via API URL

MEDIUM Published 2022-05-14 Modified 2025-03-13 Official page ↗
Aliases
CVE-2016-3727
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.652, < 2.3 → fixed in 2.3 • Maven org.jenkins-ci.main:jenkins-core: < 1.651.2 → fixed in 1.651.2

Description

The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2016-3727 The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References