CVE-2015-5317 KEV High · 7.5 EPSS 23.0%

Jenkins User Interface (UI) Information Disclosure Vulnerability

Jenkins · Jenkins User Interface (UI)

Summary

The Jenkins User Interface (UI) contains a flaw in its Fingerprints pages, which are part of the Jenkins product. An unauthenticated remote attacker can exploit it with a direct request to those pages, requiring no user interaction, to obtain sensitive job and build name information.

Official description · NVD

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

Breakdown

62.8 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Gather details about target systemsT1592 · Gather Victim Host InformationAI-written (claude-haiku-5-5)Medium confidence

First seen exploited 7 years after disclosure.

Disclosed25 Nov 2015day 0
First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees12 May 2023+7 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

ReconnaissanceTA0043

Gather Victim Host Information T1592 Medium

AI mapping from the description · primary impact

Leaks job and build names, gathering victim information

might allow remote attackers to obtain sensitive job and build name information

From the official description (NVD) Original ↗

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Remote unauthenticated direct request to public web UI

might allow remote attackers to obtain sensitive job

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 149 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-5317 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.

Mavenorg.jenkins-ci.main:jenkins-coreGHSA-8pqx-3rxx-f5pm

Upgrade to 1.642.2

Fixes this CVE and 1 other known vulnerability in this package (CVE-2016-0792).

Still affected on this line by CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).

Set the version to 1.642.2 or later in your pom.xml or build.gradle.

First fixed in 1.638 for CVE-2015-5317.

Affected versions, by release line

If you run	Upgrade to
1.626 up to 1.638	1.642.2first fix for this CVE: 1.638
All versions before 1.625.2 Still affected on this line by CVE-2016-0792 (fixed in 1.642.2, a newer line); CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).	1.625.2

If you run

Upgrade to

1.626 up to 1.638

1.642.2first fix for this CVE: 1.638

All versions before 1.625.2

Still affected on this line by CVE-2016-0792 (fixed in 1.642.2, a newer line); CVE-2016-9299 (fixed in 2.19.3, a newer line); CVE-2017-1000353 (fixed in 2.46.2, a newer line); CVE-2018-1000861 (fixed in 2.138.4, a newer line); CVE-2018-1999002 (fixed in 2.121.2, a newer line); CVE-2019-10405 (fixed in 2.176.4, a newer line); CVE-2020-2230 (fixed in 2.235.4, a newer line); CVE-2024-23897 (fixed in 2.426.3, a newer line); CVE-2025-59474 (fixed in 2.516.3, a newer line); CVE-2026-53435 (fixed in 2.555.3, a newer line).

1.625.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

4 links, grouped by NVD tag (3 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 12 May 2023. Federal due date 2 Jun 2023. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 12 May 2023. EUVD-2015-5288

No public exploit code found.

, 30 Oct 2026

23.0%Top 2.3%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 97.7%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1268 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9775 19.6/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total62.8

Record

Published: 25 Nov 2015
Modified: 17 Jun 2026
: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ReconnaissanceTA0043

Initial AccessTA0001

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 2

How attackers get in

What they do

techniques