CVE-2015-5317Jenkins User Interface (UI) Information Disclosure Vulnerability

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

7.5 HIGHEPSS 23.00%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 00:28 UTC

OverviewCVSS details

7.5HIGHCVSS 3.1

Score source: CISA-ADP
NVD status: Analyzed
Published: Nov 25, 2015
Assigner: redhat

Affected

jenkins (jenkins)

Versions: through 1.637 · through 1.625.1

+1 more product →

Exploitation

Public exploit: None listed
CISA KEV: Listed · May 12, 2023
KEV due date: Jun 2, 2023
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact partial

EPSS · FIRST, scored Nov 7

23.00%chance of exploitation in 30 days

Higher than 97.76% of CVEs

CVSS 3.1 · CISA-ADP

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

CVSS 2.0 · NVD

5.0Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack vector: Network
Attack complexity: Low
Authentication: None
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.5	HIGH	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5.0	MEDIUM	2.0NVD	AV:N/AC:L/Au:N/C:P/I:N/A:N

CISA required action

⚡ Known exploited · remediation due Jun 2, 2023

Apply updates per vendor instructions.

Details

CVE ID: CVE-2015-5317
Status: Analyzed
Assigner (CNA): redhat
Published: Nov 25, 2015
Last modified: 2026-06-17 00:28 UTC
Weaknesses: CWE-200

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 13:52 UTC.