CVE-2015-5317
Jenkins User Interface (UI) Information Disclosure Vulnerability
Description
CVE-2015-5317 is an information disclosure vulnerability in Jenkins, the popular open-source automation server. The flaw exists in the Fingerprints pages of Jenkins versions before 1.638 and LTS versions before 1.625.2, where insufficient access controls allow remote attackers to obtain sensitive job and build name information via direct requests. This exposure of sensitive information vulnerability requires no authentication or user interaction, making it trivially exploitable over the network. CVE-2015-5317 is listed in CISA's Known Exploited Vulnerabilities catalog, and with an EPSS score of 27.4% (96th percentile), the likelihood of exploitation is substantial. The vulnerability also affects Red Hat OpenShift environments that bundle Jenkins.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jenkins | jenkins | <= 1.637; <= 1.625.1 |
| redhat | openshift | 2.0; <= 3.1 |
References
- http://rhn.redhat.com/errata/RHSA-2016-0489.html(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2016:0070(Third Party Advisory)
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5317(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes a weakness where an application inadvertently exposes sensitive information to actors who are not authorized to access it. In CVE-2015-5317, the Jenkins Fingerprints pages fail to enforce proper access controls, allowing unauthenticated remote users to directly access pages that reveal sensitive job names and build identifiers that should be restricted to authenticated users.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
Attack Vector (Network): CVE-2015-5317 is remotely exploitable without physical access, meaning any attacker who can reach the Jenkins web interface over the network can exploit this vulnerability. Attack Complexity (Low): Exploitation is straightforward and requires no special conditions or preparation. Privileges Required (None): No authentication is needed to access the vulnerable Fingerprints pages, making this vulnerability accessible to any unauthenticated attacker. User Interaction (None): No action from a legitimate user is required for the attack to succeed. Confidentiality (High): Successful exploitation exposes sensitive job and build name information, which can reveal details about an organization's CI/CD pipeline, project structure, and internal naming conventions. Integrity and Availability (None): This vulnerability does not directly enable data modification or service disruption. The CVSS score of 7.5 (High severity) reflects the serious confidentiality impact of unauthenticated information disclosure. With an EPSS score of 27.4% (96th percentile), CVE-2015-5317 faces a significant probability of exploitation, and CISA's inclusion in the KEV catalog confirms real-world attack activity.
Exploit Maturity
Active exploitation of CVE-2015-5317 has been confirmed by CISA, which added this Jenkins information disclosure vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 27.4% places this vulnerability in the 96th percentile, indicating a high probability of exploitation activity. While no specific public exploit code tagged as "Exploit" appears in the NVD references, the trivial nature of this vulnerability's exploitation path—requiring only direct HTTP requests to the Fingerprints pages without authentication—means that dedicated exploit tooling is unnecessary. The ransomware usage status is currently unknown, but the information disclosed through this vulnerability could serve as reconnaissance for more severe follow-up attacks against the Jenkins environment.
Remediation
- Upgrade Jenkins immediately as directed by CISA's required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Upgrade Jenkins to version 1.638 or later (or LTS version 1.625.2 or later) to resolve CVE-2015-5317 as detailed in the Jenkins Security Advisory 2015-11-11.
- Update Red Hat OpenShift environments that bundle Jenkins by applying RHSA-2016:0070 and RHSA-2016:0489, which include the patched Jenkins versions.
- Restrict network access to Jenkins by implementing firewall rules or reverse proxy authentication to ensure that only authorized users can reach the Jenkins web interface. Placing Jenkins behind a VPN or restricting access to trusted IP ranges significantly reduces the attack surface for this unauthenticated vulnerability.
- Review Jenkins authorization settings to ensure that the project-based matrix authorization strategy or role-based access control plugin is properly configured. Enable "Prevent Cross Site Request Forgery exploits" and verify that anonymous read access is disabled.
- Audit access logs for signs of exploitation by searching for unusual or unauthenticated requests to Fingerprints-related URLs in the Jenkins access logs, which may indicate reconnaissance or active information harvesting.
Technical Details
Vulnerability mechanism: CVE-2015-5317 exists in the Jenkins Fingerprints pages, which are used to track file fingerprints across builds and jobs. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information), where the Fingerprints endpoint fails to enforce proper authorization checks before returning responses that contain job and build name information. Exploitation technique: An unauthenticated attacker can send direct HTTP requests to the Fingerprints pages on a Jenkins instance accessible over the network, bypassing the intended access controls to retrieve sensitive information about job configurations and build identifiers. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms that this is a network-accessible, low-complexity attack requiring no privileges or user interaction, with high confidentiality impact. Root cause: The Fingerprints pages lacked proper permission checks that should have verified whether the requesting user had the appropriate credentials to view job and build information, a pattern that was addressed in Jenkins 1.638 and LTS 1.625.2 by adding the necessary authorization checks.
Frequently Asked Questions
Is CVE-2015-5317 being actively exploited?
Yes, CVE-2015-5317 is confirmed to be actively exploited in the wild. CISA has added this Jenkins vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 27.4% (96th percentile) indicates a high likelihood of ongoing exploitation activity.
What products are affected by CVE-2015-5317?
CVE-2015-5317 affects Jenkins versions before 1.638 and Jenkins LTS versions before 1.625.2. Red Hat OpenShift environments that include bundled Jenkins installations are also affected. Organizations running any of these versions should treat this as a high-priority security issue.
How do I fix CVE-2015-5317?
Upgrade Jenkins to version 1.638 or later, or LTS version 1.625.2 or later, as described in the Jenkins Security Advisory 2015-11-11. For Red Hat OpenShift, apply RHSA-2016:0070 and RHSA-2016:0489. Additionally, restrict network access to the Jenkins interface and ensure proper authorization is configured. See the Remediation section for detailed steps.
How severe is CVE-2015-5317?
CVE-2015-5317 has a CVSS v3.1 base score of 7.5 (High severity), reflecting the ability for unauthenticated remote attackers to access sensitive information without any user interaction. The EPSS percentile of 96.3% places it among the most likely-to-be-exploited vulnerabilities. While it only affects confidentiality, the exposed information can enable further attacks against the Jenkins environment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.