{"id":"CVE-2015-5317","aliases":[],"url":"https://o3.security/vulnerability/CVE-2015-5317","summary":"Jenkins discloses project names via fingerprints","details":"The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.","published":"2022-05-13T01:30:06Z","modified":"2025-10-22T19:26:24.704289Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H"},"epss":{"score":0.22429,"percentile":0.97517,"asOf":"2026-08-27"},"cisaKev":{"dateAdded":"2023-05-12","dueDate":"2023-06-02","knownRansomwareCampaignUse":false},"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.main:jenkins-core","fixedVersion":"1.625.2"},{"ecosystem":"Maven","name":"org.jenkins-ci.main:jenkins-core","fixedVersion":"1.638"}],"fix":{"url":"https://github.com/jenkinsci/jenkins/commit/0594c4cbccd24d4883fc0150e8fc511c9da63eb4","label":"jenkinsci/jenkins@0594c4c"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5317"},{"type":"WEB","url":"https://github.com/jenkinsci/jenkins/commit/0594c4cbccd24d4883fc0150e8fc511c9da63eb4"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:0070"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/jenkins"},{"type":"WEB","url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5317"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2016-0489.html"}],"provenance":{"sources":["OSV.dev","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2025-10-22T19:26:24.704289Z"}}