CVE-2015-7538 — Cross-Site Request Forgery in Jenkins

CWE-352 — Cross-Site Request Forgery8 documents7 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 53.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
JenkinsRedhat Openshift
Timeline
PublishedFeb 3
Latest updateMay 13

Description

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDjenkins/jenkins1.625.1+1
▶NVDredhat/openshift3.1+1

🔴Vulnerability Details

3
GHSA
Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack↗2022-05-13
▶
OSV
Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack↗2022-05-13
▶
CVEList
CVE-2015-7538: Jenkins before 1↗2016-02-03
▶

📋Vendor Advisories

2
Red Hat
jenkins: CSRF protection ineffective (SECURITY-233)↗2015-12-09
▶
Jenkins
Jenkins Security Advisory 2015-12-09↗2015-12-09
▶

💬Community

2
Bugzilla
CVE-2015-7536 CVE-2015-7537 CVE-2015-7538 CVE-2015-7539 jenkins: various flaws [fedora-all]↗2015-12-15
▶
Bugzilla
CVE-2015-7538 jenkins: CSRF protection ineffective (SECURITY-233)↗2015-12-15
▶
CVE-2015-7538 — Cross-Site Request Forgery in Jenkins | cvebase