{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-05-11T00:00:00", "descriptions": [{"lang": "en", "value": "The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cloudbees.com/jenkins-security-advisory-2016-05-11"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11"}, {"name": "RHSA-2016:1206", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2016:1206"}, {"name": "RHSA-2016:1773", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-1773.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2016-3727", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.cloudbees.com/jenkins-security-advisory-2016-05-11", "refsource": "CONFIRM", "url": "https://www.cloudbees.com/jenkins-security-advisory-2016-05-11"}, {"name": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11", "refsource": "CONFIRM", "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11"}, {"name": "RHSA-2016:1206", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:1206"}, {"name": "RHSA-2016:1773", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-1773.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:03:34.534Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cloudbees.com/jenkins-security-advisory-2016-05-11"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11"}, {"name": "RHSA-2016:1206", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2016:1206"}, {"name": "RHSA-2016:1773", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-1773.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-3727", "datePublished": "2016-05-17T14:00:00", "dateReserved": "2016-03-30T00:00:00", "dateUpdated": "2024-08-06T00:03:34.534Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A979807-E051-4BD5-8811-85FED039DB59", "versionEndIncluding": "2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "matchCriteriaId": "587BB544-D4F5-4540-8A61-578FD30DB508", "versionEndIncluding": "1.651.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:*", "matchCriteriaId": "F8E35FAB-695F-44DA-945D-60B47C1F200B", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift:3.2:*:*:*:enterprise:*:*:*", "matchCriteriaId": "F33CEF04-05FA-444C-BB14-F3E3434AF61F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors."}, {"lang": "es", "value": "La URL API computer/(master)/api/xml en Jenkins en versiones anteriores a 2.3 y LTS en versiones anteriores a 1.651.2 permite a usuarios remotos autenticados con permiso avanzado de lectura para el nodo maestro obtener informaci\u00f3n sensible sobre la configuraci\u00f3n global a trav\u00e9s de vectores no especificados."}], "id": "CVE-2016-3727", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-05-17T14:08:11.717", "references": [{"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2016-1773.html"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2016:1206"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://www.cloudbees.com/jenkins-security-advisory-2016-05-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-1773.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2016:1206"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.cloudbees.com/jenkins-security-advisory-2016-05-11"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2016:1206", "cpe": "cpe:/a:redhat:openshift:3.2::el7", "package": "jenkins-0:1.651.2-1.el7", "product_name": "Red Hat OpenShift Container Platform 3.2", "release_date": "2016-06-06T00:00:00Z"}, {"advisory": "RHSA-2016:1206", "cpe": "cpe:/a:redhat:openshift:3.2::el7", "package": "jenkins-plugin-openshift-pipeline-0:1.0.12-1.el7", "product_name": "Red Hat OpenShift Container Platform 3.2", "release_date": "2016-06-06T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "activemq-0:5.9.0-6.redhat.611463.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "ImageMagick-0:6.7.2.7-5.el6_8", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "jenkins-0:1.651.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "libcgroup-0:0.40.rc1-18.el6_8", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-broker-0:1.16.3.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-broker-util-0:1.37.6.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-cron-0:1.25.4.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-diy-0:1.26.2.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-haproxy-0:1.31.6.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-jbosseap-0:2.27.4.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-jbossews-0:1.35.5.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-jenkins-0:1.29.2.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-jenkins-client-0:1.26.1.1-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-mongodb-0:1.26.2.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-mysql-0:1.31.3.3-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-nodejs-0:1.33.1.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-perl-0:1.30.2.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-php-0:1.35.4.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-python-0:1.34.3.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-cartridge-ruby-0:1.32.2.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-msg-node-mcollective-0:1.30.2.2-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-node-proxy-0:1.26.3.1-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "openshift-origin-node-util-0:1.38.7.1-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "rhc-0:1.38.7.1-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "rubygem-openshift-origin-admin-console-0:1.28.2.1-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "rubygem-openshift-origin-controller-0:1.38.6.4-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "rubygem-openshift-origin-frontend-haproxy-sni-proxy-0:0.5.2.1-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "rubygem-openshift-origin-msg-broker-mcollective-0:1.36.2.4-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "rubygem-openshift-origin-node-0:1.38.6.4-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1773", "cpe": "cpe:/a:redhat:openshift:2.0::el6", "package": "rubygem-openshift-origin-routing-daemon-0:0.26.6.1-1.el6op", "product_name": "Red Hat OpenShift Enterprise 2.2", "release_date": "2016-08-24T00:00:00Z"}, {"advisory": "RHSA-2016:1206", "cpe": "cpe:/a:redhat:openshift:3.1::el7", "package": "jenkins-0:1.651.2-1.el7", "product_name": "Red Hat OpenShift Enterprise 3.1", "release_date": "2016-06-06T00:00:00Z"}, {"advisory": "RHSA-2016:1206", "cpe": "cpe:/a:redhat:openshift:3.1::el7", "package": "jenkins-plugin-openshift-pipeline-0:1.0.12-1.el7", "product_name": "Red Hat OpenShift Enterprise 3.1", "release_date": "2016-06-06T00:00:00Z"}], "bugzilla": {"description": "jenkins: Granting the permission to read node configurations allows access to overall system configuration (SECURITY-281)", "id": "1335422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335422"}, "csaw": false, "cvss": {"cvss_base_score": "4.0", "cvss_scoring_vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "status": "verified"}, "details": ["The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors."], "name": "CVE-2016-3727", "public_date": "2016-05-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-3727\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-3727\nhttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11"], "threat_severity": "Moderate"}