What is GHSA-6cr3-cm5h-8q96?

GHSA-6cr3-cm5h-8q96 is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Exposes Sensitive Information via API URL

Which CVE IDs does GHSA-6cr3-cm5h-8q96 cover?

GHSA-6cr3-cm5h-8q96 covers the following CVE IDs: CVE-2016-3727. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6cr3-cm5h-8q96?

GHSA-6cr3-cm5h-8q96 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6cr3-cm5h-8q96?

GHSA-6cr3-cm5h-8q96 affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 1.652, \u003c 2.3; maven/org.jenkins-ci.main:jenkins-core:\u003c 1.651.2.

GHSA-6cr3-cm5h-8q96MediumCVSS 4.3

Jenkins Exposes Sensitive Information via API URL

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

March 13, 2025

🔗 CVE IDs covered (1)

CVE-2016-3727 →

📋 Description

The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 1.652, < 2.3
maven/org.jenkins-ci.main:jenkins-core:< 1.651.2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2016-3727
https://access.redhat.com/errata/RHSA-2016:1206
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
https://www.cloudbees.com/jenkins-security-advisory-2016-05-11
http://rhn.redhat.com/errata/RHSA-2016-1773.html
https://github.com/jenkinsci/jenkins/commit/d66ad6f3ee46a5c6bb865bb831e8cdfc74cd7eb3
https://github.com/advisories/GHSA-6cr3-cm5h-8q96