PT-2016-5678 · Cloudbees+1 · Jenkins

Stephen Connolly · Published 2016-05-17 · Updated 2025-06-06 · CVE-2016-3721

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.3 Jenkins LTS versions prior to 1.651.2

Description The issue allows remote authenticated users to inject arbitrary build parameters into the build environment via environment variables. This can be achieved by manipulating environment variables.

Recommendations For Jenkins versions prior to 2.3, update to version 2.3 or later to resolve the issue. For Jenkins LTS versions prior to 1.651.2, update to version 1.651.2 or later to resolve the issue. As a temporary workaround, consider restricting access to environment variables in the build environment until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-17

CWE-94

Related Identifiers

CVE-2016-3721

GHSA-QF2H-H3XQ-J93J

RHSA-2016:1206

RHSA-2016:1773

Affected Products

Jenkins

References · 15

• https://wiki.jenkins-ci.org/display/JENKINS/Plugins+affected+by+fix+for+SECURITY-170 · Vendor Advisory
• https://cloudbees.com/jenkins-security-advisory-2016-05-11 · Vendor Advisory
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:1206 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3721 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-1773.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qf2h-h3xq-j93j · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://t.me/cvenotify/78901 · Telegram Post
• http://openwall.com/lists/oss-security/2024/05/02/3 · Note
• https://t.me/cvenotify/78849 · Telegram Post
• https://t.me/cvenotify/124924 · Telegram Post
• https://t.me/cvenotify/78836 · Telegram Post
• https://twitter.com/CVEnew/status/1786027485957857379 · Twitter Post