CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVE-2016-3721
Medium (4.3). EPSS 2.1% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 1.651.2, 2.3.
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-17
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
- redhat:openshift
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qf2h-h3xq-j93j | Maven | org.jenkins-ci.main:jenkins-core | >=1.660 <2.3 | 2.3 |
| GHSA-qf2h-h3xq-j93j | Maven | org.jenkins-ci.main:jenkins-core | <1.651.2 | 1.651.2 |
References
- http://rhn.redhat.com/errata/RHSA-2016-1773.html
- http://www.openwall.com/lists/oss-security/2024/05/02/3
- https://access.redhat.com/errata/RHSA-2016:1206
- https://wiki.jenkins-ci.org/display/JENKINS/Plugins+affected+by+fix+for+SECURITY-170
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11