ACTIVELY EXPLOITED
CVE-2015-5317: Jenkins User Interface (UI) Information Disclosure Vulnerability
| Vendor | Jenkins |
|---|---|
| Product | Jenkins User Interface (UI) |
| Actively exploited | Yes |
| Added to CISA KEV | 12 May 2023 |
| CISA federal deadline | 2 Jun 2023 |
| Weakness (CWE) | CWE-200 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.
SOURCES
Other Jenkins flaws
- CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability
- CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
- CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Vulnerability
- CVE-2019-1003030: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
- CVE-2018-1000861: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.