---
id: "CVE-2015-5317"
kind: "vulnerability"
aliases: ["CVE-2015-5317"]
title: "The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain\u2026"
severity: "high"
cvss: 7.5
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Jenkins Jenkins User Interface (UI)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "jenkins", "fixed": [], "affected": "<= 1.637", "ecosystem": "vendor"}, {"name": "jenkins", "fixed": [], "affected": "<= 1.625.1", "ecosystem": "vendor"}, {"name": "redhat openshift", "fixed": [], "affected": "= 2.0", "ecosystem": "vendor"}, {"name": "redhat openshift", "fixed": [], "affected": "<= 3.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "jenkins", "runtime", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2015-11-25T20:59:07+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5317", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5317", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain…

Jenkins' web UI shows names of jobs and builds on the Fingerprints pages to users who should not have access to them. An attacker with a Jenkins login can read job and build names they are not authorised to see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Jenkins Jenkins User Interface (UI) affected ? fixed ?
- vendor:jenkins affected <= 1.637 fixed ?
- vendor:jenkins affected <= 1.625.1 fixed ?
- vendor:redhat openshift affected = 2.0 fixed ?
- vendor:redhat openshift affected <= 3.1 fixed ?

## Fix

Apply the Jenkins update the vendor provides per CISA's required action; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5317
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-5317

## From the sources

Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_