5

CVE-2015-5320

EPSS 0.21%
Published 25.11.2015 20:59:11
Last modified 12.04.2025 10:46:40
Source secalert@redhat.com
Teams watchlist Login
Open Login

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.

Affected products Warnungen 0 Metrics 2 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Redhat ≫ Openshift SwEditionenterprise Version <= 3.1

Jenkins ≫ Jenkins Version <= 1.637

Jenkins ≫ Jenkins SwEditionlts Version <= 1.625.1

Redhat ≫ Openshift Version2.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.21%	0.436

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://access.redhat.com/errata/RHSA-2016:0070

http://rhn.redhat.com/errata/RHSA-2016-0489.html

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2015-5320

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-5320

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-5320

EUVD