CVE-2015-5322

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.

Score

CVSS 2.0 5.0 Medium

Status

Modified - secalert@redhat.com

Published

2015-11-25

Last modified

2024-08-06

Weaknesses

CWE-22

Affected products

• Jenkins (Jenkins)
• Openshift (Redhat)

References

• http://rhn.redhat.com/errata/RHSA-2016-0489.html
• https://access.redhat.com/errata/RHSA-2016:0070
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11