GitHub Advisoryadvisory · Maven

GHSA-x274-9m9r-fm5g Jenkins does not Verify Checksums for Plugin Files

HIGH Published 2022-05-13 Modified 2025-03-13 Official page ↗
Aliases
CVE-2015-7539
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-345
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 1.625.2 → fixed in 1.625.2 • Maven org.jenkins-ci.main:jenkins-core: >= 1.626, < 1.640 → fixed in 1.640

Description

The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

Related

Alias · CVE (1)

  • CVE-2015-7539 The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site… vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References