CVE-2015-7539

HIGH7.5EPSS 0.77%

Jenkins does not Verify Checksums for Plugin Files

Published: 5/13/2022Modified: 3/13/2025

Description

The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.

Affected packages (1)

Maven/org.jenkins-ci.main:jenkins-corefrom 0, < 1.625.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References (10)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2015-7539
PATCHhttps://github.com/jenkinsci/jenkins
WEBhttp://rhn.redhat.com/errata/RHSA-2016-0489.html
WEBhttps://access.redhat.com/errata/RHSA-2016:0070
WEBhttps://github.com/jenkinsci/jenkins/commit/11479a2cc0a322a6bcd7e65667f3d24aa4d444bb
WEBhttps://github.com/jenkinsci/jenkins/commit/97adb71aa4509f91e408a16ba312e817ec015cf4
WEBhttps://github.com/jenkinsci/jenkins/commit/9ec88357a354d8354728cc06e2b8c8b68aee58bf
WEBhttps://github.com/jenkinsci/jenkins/commit/c158648afa8888bc49ac337c973d4e4bc050118e
WEBhttps://github.com/jenkinsci/jenkins/commit/f99cb46e06f394637067730a82f46bddc3567295
WEBhttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09