CVE-2016-3725 — Vulnetix

Try Vulnetix Request Demo

CVE-2016-3725 PUBLISHED CVSS 5 MEDIUM

Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).

EPSS 0.16% · 37.0th percentile

Risk Scores

CVSS v2.0

5

EPSS Score

0.16%

37.0th percentile

Affected Products

Vendor	Product	Versions
jenkins	jenkins	0, 0
n/a	n/a	n/a
redhat	openshift	3.1, 3.2
Maven	org.jenkins-ci.main:jenkins-core	0

Timeline

May 17, 2016 CVE Published
Jan 5, 2018 CVE Updated
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score

References

https://www.cloudbees.com/jenkins-security-advisory-2016-05-11 url
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 url
RHSA-2016:1206 vendor-advisory
RHSA-2016:1773 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-3725 advisory

Open in Interactive Console →