PT-2016-5678 · Cloudbees+1 · Jenkins

Stephen Connolly · Publicado 2016-05-17 · Atualizado 2025-06-06 · CVE-2016-3721

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.3 Jenkins LTS versions prior to 1.651.2

Description The issue allows remote authenticated users to inject arbitrary build parameters into the build environment via environment variables. This can be achieved by manipulating environment variables.

Recommendations For Jenkins versions prior to 2.3, update to version 2.3 or later to resolve the issue. For Jenkins LTS versions prior to 1.651.2, update to version 1.651.2 or later to resolve the issue. As a temporary workaround, consider restricting access to environment variables in the build environment until a patch is available.

Correção

Code Injection

Enumeração de Fraquezas

CWE-17

CWE-94

Identificadores relacionados

CVE-2016-3721

GHSA-QF2H-H3XQ-J93J

RHSA-2016:1206

RHSA-2016:1773

Produtos afetados

Jenkins

Referências · 15

• https://github.com/jenkinsci/jenkins · Nota
• https://wiki.jenkins-ci.org/display/JENKINS/Plugins+affected+by+fix+for+SECURITY-170 · Aviso do Fabricante
• https://cloudbees.com/jenkins-security-advisory-2016-05-11 · Aviso do Fabricante
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 · Aviso do Fabricante
• https://t.me/cvenotify/78901 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2016:1206 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-3721 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3721 · Nota de Segurança
• http://openwall.com/lists/oss-security/2024/05/02/3 · Nota
• http://rhn.redhat.com/errata/RHSA-2016-1773.html · Aviso do Fabricante
• https://t.me/cvenotify/78849 · Publicação no Telegram
• https://t.me/cvenotify/124924 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-qf2h-h3xq-j93j · Aviso do Fabricante
• https://t.me/cvenotify/78836 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1786027485957857379 · Publicação no Twitter