CVE-2016-3723
Fixed in a distro release EPSS 2%
Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.
Products: jenkins, redhat openshift
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 2.0 | ImageMagick | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-debuginfo | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-devel | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-doc | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | ImageMagick-perl | 0:6.7.2.7-5.el6_8 |
| Red Hat openshift 2.0 | activemq | 0:5.9.0-6.redhat.611463.el6op |
| Red Hat openshift 2.0 | activemq-client | 0:5.9.0-6.redhat.611463.el6op |
| Red Hat openshift 2.0 | jenkins | 0:1.651.2-1.el6op |
| Red Hat openshift 2.0 | libcgroup | 0:0.40.rc1-18.el6_8 |
| Red Hat openshift 2.0 | libcgroup-debuginfo | 0:0.40.rc1-18.el6_8 |
| Red Hat openshift 2.0 | libcgroup-pam | 0:0.40.rc1-18.el6_8 |
| Red Hat openshift 2.0 | openshift-origin-broker | 0:1.16.3.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-broker-util | 0:1.37.6.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-cron | 0:1.25.4.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-diy | 0:1.26.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-haproxy | 0:1.31.6.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jbosseap | 0:2.27.4.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jbossews | 0:1.35.5.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jenkins | 0:1.29.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-jenkins-client | 0:1.26.1.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-mongodb | 0:1.26.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-mysql | 0:1.31.3.3-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-nodejs | 0:1.33.1.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-perl | 0:1.30.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-php | 0:1.35.4.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-python | 0:1.34.3.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-ruby | 0:1.32.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-msg-node-mcollective | 0:1.30.2.2-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-node-proxy | 0:1.26.3.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-node-util | 0:1.38.7.1-1.el6op |
| Red Hat openshift 2.0 | rhc | 0:1.38.7.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-admin-console | 0:1.28.2.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-controller | 0:1.38.6.4-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-frontend-haproxy-sni-proxy | 0:0.5.2.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-msg-broker-mcollective | 0:1.36.2.4-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-node | 0:1.38.6.4-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-routing-daemon | 0:0.26.6.1-1.el6op |
| Red Hat openshift 3.1 | jenkins | 0:1.651.2-1.el7 |
| Red Hat openshift 3.1 | jenkins-plugin-openshift-pipeline | 0:1.0.12-1.el7 |
| Red Hat openshift 3.2 | jenkins | 0:1.651.2-1.el7 |
| Red Hat openshift 3.2 | jenkins-plugin-openshift-pipeline | 0:1.0.12-1.el7 |