GitHub Advisoryadvisory · Maven

GHSA-x4m5-j4x4-4wjg Jenkins allows Administrators to Access API Tokens

MEDIUM Published 2022-05-13 Modified 2025-03-13 Official page ↗
Aliases
CVE-2015-5323
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-522
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 1.625.2 → fixed in 1.625.2 • Maven org.jenkins-ci.main:jenkins-core: >= 1.626, < 1.638 → fixed in 1.638

Description

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.

Related

Alias · CVE (1)

  • CVE-2015-5323 Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References