GitHub Advisoryadvisory · Maven

GHSA-qf2h-h3xq-j93j Jenkins allows Remote Users to Inject Build Parameters

MEDIUM Published 2022-05-14 Modified 2025-03-13 Official page ↗
Aliases
CVE-2016-3721
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-94
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.660, < 2.3 → fixed in 2.3 • Maven org.jenkins-ci.main:jenkins-core: < 1.651.2 → fixed in 1.651.2

Description

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.

Related

Alias · CVE (1)

  • CVE-2016-3721 Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References