Description

CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2016-1773.html

https://access.redhat.com/errata/RHSA-2016:0711

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24

Related Vulnerabilities

CVE-2020-15095 Vulnerability in npm package npm

CVE-2023-25158 Vulnerability in maven package org.geotools:gt-jdbc

CVE-2022-31160 Vulnerability in maven package org.webjars.bower:jquery-ui

CVE-2021-21318 Vulnerability in maven package org.opencastproject:opencast-search-service-impl

CVE-2016-10550 Vulnerability in npm package sequelize

Severity

High

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Vendor Advisory