Improper Neutralization of Input During Web Page Generation in Jenkins

MEDIUM 5.4CVE-2015-7536 · GHSA-x3p3-929j-pq66 · Published 03/02/2016 · updated 17/06/2026

In short

CVE-2015-7536 is a MEDIUM (CVSS 5.4) vulnerability affecting org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 69.4% of all vulnerabilities.
Fix: update to 1.640, 1.625.2 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 1.626, < 1.640< 1.625.2`	`1.6401.625.2`
jenkins jenkins	`≤ 1.625.1≤ 1.639`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-7536 · ADVISORY
jenkinsci/jenkins commit 27c3034 · WEB
jenkinsci/jenkins commit d3fb2c0 · WEB
jenkinsci/jenkins · PACKAGE
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09 · WEB

More vulnerabilities in org.jenkins-ci.main:jenkins-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.main:jenkins-core

Maven

≥ 1.626, < 1.640< 1.625.2

1.6401.625.2

jenkins

≤ 1.625.1≤ 1.639

No fix yet

Description

NVD description

More vulnerabilities in org.jenkins-ci.main:jenkins-core

See all →