Description

CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Remediation

References

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24

https://access.redhat.com/errata/RHSA-2016:0711

http://rhn.redhat.com/errata/RHSA-2016-1773.html

Related Vulnerabilities

CVE-2023-45669 Vulnerability in maven package com.webauthn4j:webauthn4j-spring-security-core

CVE-2023-33201 Vulnerability in maven package org.bouncycastle:bcprov-jdk15on

CVE-2023-25813 Vulnerability in npm package sequelize

CVE-2021-4329 Vulnerability in npm package json-logic-js

CVE-2021-23820 Vulnerability in npm package json-pointer

Severity

High

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Vendor Advisory