CVE-2016-3727
MEDIUM4.3EPSS 0.09%Jenkins Exposes Sensitive Information via API URL
發布日:2022/5/14修改日:2025/3/13
描述
The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.
受影響套件(1)
- Maven/org.jenkins-ci.main:jenkins-core>= 1.652, < 2.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-3727
- PATCHhttps://github.com/jenkinsci/jenkins
- WEBhttp://rhn.redhat.com/errata/RHSA-2016-1773.html
- WEBhttps://access.redhat.com/errata/RHSA-2016:1206
- WEBhttps://github.com/jenkinsci/jenkins/commit/d66ad6f3ee46a5c6bb865bb831e8cdfc74cd7eb3
- WEBhttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
- WEBhttps://www.cloudbees.com/jenkins-security-advisory-2016-05-11