Every CVE Search/ Get API key

CVE-2016-3723

Exposure of Sensitive Information in Jenkins Core

4.3 MediumFix available

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.93%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

Record
CVE-2016-3723
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

Record
CVE-2016-3723
Updated
2026-11-02
EUVDEUVD-2022-3108 No score

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

Record
EUVD-2022-3108
Updated
2026-11-03
GitHub AdvisoriesGHSA-8572-5jrg-mx52 4.3

Exposure of Sensitive Information in Jenkins Core

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

Record
GHSA-8572-5jrg-mx52
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 4.3

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

Record
CVE-2016-3723
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-8572-5jrg-mx52 4.3

Exposure of Sensitive Information in Jenkins Core

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

Record
GHSA-8572-5jrg-mx52
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVRHSA-2016:1773 4.8

Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update

Record
RHSA-2016:1773
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.main:jenkins-core
Maven
 before 2.3
2.3
org.jenkins-ci.main:jenkins-core
Maven
 before 2.3, plus listed versions
1.3961.3971.3981.3991.400
Show 45 moreShow less
1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437
2.3
jenkins
Red Hat:openshift:3.1::el7
 before 0:1.651.2-1.el7
0:1.651.2-1.el7
jenkins-plugin-openshift-pipeline
Red Hat:openshift:3.1::el7
 before 0:1.0.12-1.el7
0:1.0.12-1.el7
jenkins
Red Hat:openshift:3.2::el7
 before 0:1.651.2-1.el7
0:1.651.2-1.el7
jenkins-plugin-openshift-pipeline
Red Hat:openshift:3.2::el7
 before 0:1.0.12-1.el7
0:1.0.12-1.el7
rhc
Red Hat:openshift:2.0::el6
 before 0:1.38.7.1-1.el6op
0:1.38.7.1-1.el6op
activemq
Red Hat:openshift:2.0::el6
 before 0:5.9.0-6.redhat.611463.el6op
0:5.9.0-6.redhat.611463.el6op
activemq-client
Red Hat:openshift:2.0::el6
 before 0:5.9.0-6.redhat.611463.el6op
0:5.9.0-6.redhat.611463.el6op
openshift-origin-broker
Red Hat:openshift:2.0::el6
 before 0:1.16.3.2-1.el6op
0:1.16.3.2-1.el6op
Show 33 moreShow less
Affected packages
PackageAffectedFixed
openshift-origin-broker-util
Red Hat:openshift:2.0::el6
 before 0:1.37.6.2-1.el6op
0:1.37.6.2-1.el6op
rubygem-openshift-origin-admin-console
Red Hat:openshift:2.0::el6
 before 0:1.28.2.1-1.el6op
0:1.28.2.1-1.el6op
rubygem-openshift-origin-controller
Red Hat:openshift:2.0::el6
 before 0:1.38.6.4-1.el6op
0:1.38.6.4-1.el6op
rubygem-openshift-origin-msg-broker-mcollective
Red Hat:openshift:2.0::el6
 before 0:1.36.2.4-1.el6op
0:1.36.2.4-1.el6op
rubygem-openshift-origin-routing-daemon
Red Hat:openshift:2.0::el6
 before 0:0.26.6.1-1.el6op
0:0.26.6.1-1.el6op
openshift-origin-cartridge-jbosseap
Red Hat:openshift:2.0::el6
 before 0:2.27.4.2-1.el6op
0:2.27.4.2-1.el6op
ImageMagick
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-debuginfo
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-devel
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-doc
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
ImageMagick-perl
Red Hat:openshift:2.0::el6
 before 0:6.7.2.7-5.el6_8
0:6.7.2.7-5.el6_8
jenkins
Red Hat:openshift:2.0::el6
 before 0:1.651.2-1.el6op
0:1.651.2-1.el6op
libcgroup
Red Hat:openshift:2.0::el6
 before 0:0.40.rc1-18.el6_8
0:0.40.rc1-18.el6_8
libcgroup-debuginfo
Red Hat:openshift:2.0::el6
 before 0:0.40.rc1-18.el6_8
0:0.40.rc1-18.el6_8
libcgroup-pam
Red Hat:openshift:2.0::el6
 before 0:0.40.rc1-18.el6_8
0:0.40.rc1-18.el6_8
openshift-origin-cartridge-cron
Red Hat:openshift:2.0::el6
 before 0:1.25.4.2-1.el6op
0:1.25.4.2-1.el6op
openshift-origin-cartridge-diy
Red Hat:openshift:2.0::el6
 before 0:1.26.2.2-1.el6op
0:1.26.2.2-1.el6op
openshift-origin-cartridge-haproxy
Red Hat:openshift:2.0::el6
 before 0:1.31.6.2-1.el6op
0:1.31.6.2-1.el6op
openshift-origin-cartridge-jbossews
Red Hat:openshift:2.0::el6
 before 0:1.35.5.2-1.el6op
0:1.35.5.2-1.el6op
openshift-origin-cartridge-jenkins
Red Hat:openshift:2.0::el6
 before 0:1.29.2.2-1.el6op
0:1.29.2.2-1.el6op
openshift-origin-cartridge-jenkins-client
Red Hat:openshift:2.0::el6
 before 0:1.26.1.1-1.el6op
0:1.26.1.1-1.el6op
openshift-origin-cartridge-mongodb
Red Hat:openshift:2.0::el6
 before 0:1.26.2.2-1.el6op
0:1.26.2.2-1.el6op
openshift-origin-cartridge-mysql
Red Hat:openshift:2.0::el6
 before 0:1.31.3.3-1.el6op
0:1.31.3.3-1.el6op
openshift-origin-cartridge-nodejs
Red Hat:openshift:2.0::el6
 before 0:1.33.1.2-1.el6op
0:1.33.1.2-1.el6op
openshift-origin-cartridge-perl
Red Hat:openshift:2.0::el6
 before 0:1.30.2.2-1.el6op
0:1.30.2.2-1.el6op
openshift-origin-cartridge-php
Red Hat:openshift:2.0::el6
 before 0:1.35.4.2-1.el6op
0:1.35.4.2-1.el6op
openshift-origin-cartridge-python
Red Hat:openshift:2.0::el6
 before 0:1.34.3.2-1.el6op
0:1.34.3.2-1.el6op
openshift-origin-cartridge-ruby
Red Hat:openshift:2.0::el6
 before 0:1.32.2.2-1.el6op
0:1.32.2.2-1.el6op
openshift-origin-msg-node-mcollective
Red Hat:openshift:2.0::el6
 before 0:1.30.2.2-1.el6op
0:1.30.2.2-1.el6op
openshift-origin-node-proxy
Red Hat:openshift:2.0::el6
 before 0:1.26.3.1-1.el6op
0:1.26.3.1-1.el6op
openshift-origin-node-util
Red Hat:openshift:2.0::el6
 before 0:1.38.7.1-1.el6op
0:1.38.7.1-1.el6op
rubygem-openshift-origin-frontend-haproxy-sni-proxy
Red Hat:openshift:2.0::el6
 before 0:0.5.2.1-1.el6op
0:0.5.2.1-1.el6op
rubygem-openshift-origin-node
Red Hat:openshift:2.0::el6
 before 0:1.38.6.4-1.el6op
0:1.38.6.4-1.el6op

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-3723 is a medium vulnerability (CVSS 4.3) in Jenkins, published May 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.3.

References

Show 74 moreShow less
This page doesn't list everything

Left out here: 282 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open