Vulnerability Details : CVE-2015-7537
Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
Vulnerability category: Cross-site request forgery (CSRF)
Threat overview for CVE-2015-7537
Top countries where our scanners detected CVE-2015-7537
Top open port discovered on systems with this issue
8088
IPs affected by CVE-2015-7537 1,845
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2015-7537!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2015-7537
Probability of exploitation activity in the next 30 days: 0.18%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 54 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-7537
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2015-7537
-
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7537
-
https://access.redhat.com/errata/RHSA-2016:0070
RHSA-2016:0070 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2016-0489.html
RHSA-2016:0489 - Security Advisory - Red Hat Customer Portal
-
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
Jenkins Security Advisory 2015-12-09 - Security Advisories - Jenkins WikiVendor Advisory
Products affected by CVE-2015-7537
- cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*