Description

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.

Remediation

References

CVE-2015-5323

Related Vulnerabilities

WordPress Plugin CopySafe Web Protection Cross-Site Request Forgery (2.5)

WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-60205)

LiteSpeed Web Server Missing Release of Memory after Effective Lifetime Vulnerability (CVE-2025-54939)

Osclass Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2016-10751)

WordPress Plugin Unyson Information Disclosure (2.7.18)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2015-5323