Jenkins allows Remote Users to Inject Build Parameters

Also known as GHSA-qf2h-h3xq-j93j

Published 10 y ago 2016-05-17 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

2.1%

percentile 82%

Public exploits

none known

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago 2024-05-02

Exploit prediction (EPSS)

2.12% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`
CNA	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:N/I:P/A:N`
GitHub	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.jenkins-ci.main:jenkins-core`	>=1.660, <2.3 <1.651.2	2.3 1.651.2

Classification

Weakness

CWE-17 DEPRECATED: Code
CWE-94 Improper Control of Generation of Code

Technology feeds

Jenkins (RSS, critical only)

References

cloudbees.com /jenkins-security-advisory-2016-05-11 · x_transferred
wiki.jenkins-ci.org /display/SECURITY/Jenkins+Security+Advisory+2016-05-11 · x_transferred
wiki.jenkins-ci.org /display/JENKINS/Plugins+affected+by+fix+for+SECURITY-170 · x_transferred
access.redhat.com /errata/RHSA-2016:1206 · vendor-advisory, x_transferred
rhn.redhat.com /errata/RHSA-2016-1773.html · vendor-advisory, x_transferred
openwall.com /lists/oss-security/2024/05/02/3 · mailing-list, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-3721 · advisory
github.com /jenkinsci/jenkins · package

Sources

CVE List: CVE-2016-3721
GitHub Advisory: GHSA-qf2h-h3xq-j93j
NVD: CVE-2016-3721

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary