Jenkins · Jenkins User Interface (UI)

CVE-2015-5317

Jenkins User Interface (UI) Information Disclosure Vulnerability

Exploited in attacks High 7.5 Attack chance: 23%

What it is

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

CISA: Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: June 2, 2023

Added to the CISA list: May 12, 2023
Published: November 25, 2015
Severity: High 7.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 23% in the top 2.3% of all known vulnerabilities
Weakness: CWE-200
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Jenkins

Added	Vulnerability	Product	Severity	Attack chance
Oct 2, 2025	Remote Code ExecutionCVE-2017-1000353	Jenkins	Critical 9.8	99.7%
Aug 19, 2024	Command Line Interface (CLI) Path TraversalCVE-2024-23897used by ransomware	Jenkins Command Line Interface (CLI)	Critical 9.8	>99.9%
Apr 25, 2022	Sandbox BypassCVE-2019-1003029	Script Security Plugin	Critical 9.9	74%
Mar 25, 2022	Remote Code ExecutionCVE-2019-1003030	Matrix Project Plugin	Critical 9.9	97%
Feb 10, 2022	Stapler Web Framework Deserialization of Untrusted DataCVE-2018-1000861	Jenkins Stapler Web Framework	Critical 9.8	98%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.