What is GHSA-89vc-7frq-2rfj?

GHSA-89vc-7frq-2rfj is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins has Local File Inclusion Vulnerability

Which CVE IDs does GHSA-89vc-7frq-2rfj cover?

GHSA-89vc-7frq-2rfj covers the following CVE IDs: CVE-2015-5322. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-89vc-7frq-2rfj?

GHSA-89vc-7frq-2rfj affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 1.626, \u003c 1.638; maven/org.jenkins-ci.main:jenkins-core:\u003c 1.625.2.

GHSA-89vc-7frq-2rfjMedium

Jenkins has Local File Inclusion Vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

March 13, 2025

🔗 CVE IDs covered (1)

CVE-2015-5322 →

📋 Description

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 1.626, < 1.638
maven/org.jenkins-ci.main:jenkins-core:< 1.625.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2015-5322
https://access.redhat.com/errata/RHSA-2016:0070
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
http://rhn.redhat.com/errata/RHSA-2016-0489.html
https://github.com/jenkinsci/jenkins/commit/5431e397216b4ab80e58bdabcb06a0066bce6592
https://github.com/advisories/GHSA-89vc-7frq-2rfj