GitHub Advisoryadvisory · Maven

GHSA-8p3c-m625-wh83 Jenkins has CRLF Injection Vulnerability in the CLI

MEDIUM Published 2022-05-14 Modified 2025-03-13 Official page ↗
Aliases
CVE-2016-0789
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-113, CWE-20
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.643, < 1.650 → fixed in 1.650 • Maven org.jenkins-ci.main:jenkins-core: < 1.642.2 → fixed in 1.642.2

Description

CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2016-0789 CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to… vulnerability

Weakness · CWE (2)

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers weakness
  • CWE-20 Improper Input Validation weakness

References