CVE-2015-5317: Jenkins discloses project names via fingerprints

May 13, 2022 (updated February 7, 2025)

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

References

access.redhat.com/errata/RHSA-2016:0070
github.com/advisories/GHSA-8pqx-3rxx-f5pm
github.com/jenkinsci/jenkins
github.com/jenkinsci/jenkins/commit/0594c4cbccd24d4883fc0150e8fc511c9da63eb4
nvd.nist.gov/vuln/detail/CVE-2015-5317
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Detect and mitigate CVE-2015-5317 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →