CVE-2016-3722

Incorrect Authorization in Jenkins Core

4.3 MediumFix available

CVE-2016-3722 is a medium vulnerability (CVSS 4.3) in Jenkins, published May 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.3.

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

2.29%Up 1.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

Record: CVE-2016-3722
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

Record: CVE-2016-3722
Updated: 2026-11-02

EUVDEUVD-2022-2132 No score

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

Record: EUVD-2022-2132
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3857-xm38-jmq2 4.3

Incorrect Authorization in Jenkins Core

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

Record: GHSA-3857-xm38-jmq2
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-863
Updated: 2026-11-02

OSV 4.3

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

Record: CVE-2016-3722
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVGHSA-3857-xm38-jmq2 4.3

Incorrect Authorization in Jenkins Core

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

Record: GHSA-3857-xm38-jmq2
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-863
Updated: 2026-11-02

OSVRHSA-2016:1773 4.8

Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update

Record: RHSA-2016:1773
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	before 2.3	2.3
`org.jenkins-ci.main:jenkins-core` Maven	before 2.3, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	2.3
`jenkins` Red Hat:openshift:3.1::el7	before 0:1.651.2-1.el7	0:1.651.2-1.el7
`jenkins-plugin-openshift-pipeline` Red Hat:openshift:3.1::el7	before 0:1.0.12-1.el7	0:1.0.12-1.el7
`jenkins` Red Hat:openshift:3.2::el7	before 0:1.651.2-1.el7	0:1.651.2-1.el7
`jenkins-plugin-openshift-pipeline` Red Hat:openshift:3.2::el7	before 0:1.0.12-1.el7	0:1.0.12-1.el7
`rhc` Red Hat:openshift:2.0::el6	before 0:1.38.7.1-1.el6op	0:1.38.7.1-1.el6op
`activemq` Red Hat:openshift:2.0::el6	before 0:5.9.0-6.redhat.611463.el6op	0:5.9.0-6.redhat.611463.el6op
`activemq-client` Red Hat:openshift:2.0::el6	before 0:5.9.0-6.redhat.611463.el6op	0:5.9.0-6.redhat.611463.el6op
`openshift-origin-broker` Red Hat:openshift:2.0::el6	before 0:1.16.3.2-1.el6op	0:1.16.3.2-1.el6op

Show 33 moreShow less

Affected packages
Package	Affected	Fixed
`openshift-origin-broker-util` Red Hat:openshift:2.0::el6	before 0:1.37.6.2-1.el6op	0:1.37.6.2-1.el6op
`rubygem-openshift-origin-admin-console` Red Hat:openshift:2.0::el6	before 0:1.28.2.1-1.el6op	0:1.28.2.1-1.el6op
`rubygem-openshift-origin-controller` Red Hat:openshift:2.0::el6	before 0:1.38.6.4-1.el6op	0:1.38.6.4-1.el6op
`rubygem-openshift-origin-msg-broker-mcollective` Red Hat:openshift:2.0::el6	before 0:1.36.2.4-1.el6op	0:1.36.2.4-1.el6op
`rubygem-openshift-origin-routing-daemon` Red Hat:openshift:2.0::el6	before 0:0.26.6.1-1.el6op	0:0.26.6.1-1.el6op
`openshift-origin-cartridge-jbosseap` Red Hat:openshift:2.0::el6	before 0:2.27.4.2-1.el6op	0:2.27.4.2-1.el6op
`ImageMagick` Red Hat:openshift:2.0::el6	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-debuginfo` Red Hat:openshift:2.0::el6	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-devel` Red Hat:openshift:2.0::el6	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-doc` Red Hat:openshift:2.0::el6	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-perl` Red Hat:openshift:2.0::el6	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`jenkins` Red Hat:openshift:2.0::el6	before 0:1.651.2-1.el6op	0:1.651.2-1.el6op
`libcgroup` Red Hat:openshift:2.0::el6	before 0:0.40.rc1-18.el6_8	0:0.40.rc1-18.el6_8
`libcgroup-debuginfo` Red Hat:openshift:2.0::el6	before 0:0.40.rc1-18.el6_8	0:0.40.rc1-18.el6_8
`libcgroup-pam` Red Hat:openshift:2.0::el6	before 0:0.40.rc1-18.el6_8	0:0.40.rc1-18.el6_8
`openshift-origin-cartridge-cron` Red Hat:openshift:2.0::el6	before 0:1.25.4.2-1.el6op	0:1.25.4.2-1.el6op
`openshift-origin-cartridge-diy` Red Hat:openshift:2.0::el6	before 0:1.26.2.2-1.el6op	0:1.26.2.2-1.el6op
`openshift-origin-cartridge-haproxy` Red Hat:openshift:2.0::el6	before 0:1.31.6.2-1.el6op	0:1.31.6.2-1.el6op
`openshift-origin-cartridge-jbossews` Red Hat:openshift:2.0::el6	before 0:1.35.5.2-1.el6op	0:1.35.5.2-1.el6op
`openshift-origin-cartridge-jenkins` Red Hat:openshift:2.0::el6	before 0:1.29.2.2-1.el6op	0:1.29.2.2-1.el6op
`openshift-origin-cartridge-jenkins-client` Red Hat:openshift:2.0::el6	before 0:1.26.1.1-1.el6op	0:1.26.1.1-1.el6op
`openshift-origin-cartridge-mongodb` Red Hat:openshift:2.0::el6	before 0:1.26.2.2-1.el6op	0:1.26.2.2-1.el6op
`openshift-origin-cartridge-mysql` Red Hat:openshift:2.0::el6	before 0:1.31.3.3-1.el6op	0:1.31.3.3-1.el6op
`openshift-origin-cartridge-nodejs` Red Hat:openshift:2.0::el6	before 0:1.33.1.2-1.el6op	0:1.33.1.2-1.el6op
`openshift-origin-cartridge-perl` Red Hat:openshift:2.0::el6	before 0:1.30.2.2-1.el6op	0:1.30.2.2-1.el6op
`openshift-origin-cartridge-php` Red Hat:openshift:2.0::el6	before 0:1.35.4.2-1.el6op	0:1.35.4.2-1.el6op
`openshift-origin-cartridge-python` Red Hat:openshift:2.0::el6	before 0:1.34.3.2-1.el6op	0:1.34.3.2-1.el6op
`openshift-origin-cartridge-ruby` Red Hat:openshift:2.0::el6	before 0:1.32.2.2-1.el6op	0:1.32.2.2-1.el6op
`openshift-origin-msg-node-mcollective` Red Hat:openshift:2.0::el6	before 0:1.30.2.2-1.el6op	0:1.30.2.2-1.el6op
`openshift-origin-node-proxy` Red Hat:openshift:2.0::el6	before 0:1.26.3.1-1.el6op	0:1.26.3.1-1.el6op
`openshift-origin-node-util` Red Hat:openshift:2.0::el6	before 0:1.38.7.1-1.el6op	0:1.38.7.1-1.el6op
`rubygem-openshift-origin-frontend-haproxy-sni-proxy` Red Hat:openshift:2.0::el6	before 0:0.5.2.1-1.el6op	0:0.5.2.1-1.el6op
`rubygem-openshift-origin-node` Red Hat:openshift:2.0::el6	before 0:1.38.6.4-1.el6op	0:1.38.6.4-1.el6op

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 74 moreShow less

This page doesn't list everything

Left out here: 282 versions. The JSON record has them.