What is GHSA-x4m5-j4x4-4wjg?

GHSA-x4m5-j4x4-4wjg is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins allows Administrators to Access API Tokens

Which CVE IDs does GHSA-x4m5-j4x4-4wjg cover?

GHSA-x4m5-j4x4-4wjg covers the following CVE IDs: CVE-2015-5323. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-x4m5-j4x4-4wjg?

GHSA-x4m5-j4x4-4wjg affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003c 1.625.2; maven/org.jenkins-ci.main:jenkins-core:\u003e= 1.626, \u003c 1.638.

GHSA-x4m5-j4x4-4wjgMedium

Jenkins allows Administrators to Access API Tokens

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

March 13, 2025

🔗 CVE IDs covered (1)

CVE-2015-5323 →

📋 Description

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:< 1.625.2
maven/org.jenkins-ci.main:jenkins-core:>= 1.626, < 1.638

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2015-5323
https://access.redhat.com/errata/RHSA-2016:0070
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
http://rhn.redhat.com/errata/RHSA-2016-0489.html
https://github.com/jenkinsci/jenkins/commit/b3f16489ad5f15c3e749ed066cf6b4251f6668c6
https://github.com/advisories/GHSA-x4m5-j4x4-4wjg