CVE-2016-3724

Jenkins Exposes Sensitive Information from Job Configuration

6.5 MediumFix available

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.19%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

Record: CVE-2016-3724
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

Record: CVE-2016-3724
Updated: 2026-11-02

EUVDEUVD-2016-4742 No score

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

Record: EUVD-2016-4742
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7vvj-qqvj-h8mc 6.5

Jenkins Exposes Sensitive Information from Job Configuration

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

Record: GHSA-7vvj-qqvj-h8mc
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV 6.5

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

Record: CVE-2016-3724
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-7vvj-qqvj-h8mc 6.5

Jenkins Exposes Sensitive Information from Job Configuration

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

Record: GHSA-7vvj-qqvj-h8mc
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVRHSA-2016:1773 4.8

Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.10 security, bug fix, and enhancement update

Record: RHSA-2016:1773
CVSS 3.0: 4.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	1.652 up to 2.3	2.3
`org.jenkins-ci.main:jenkins-core` Maven	before 1.651.2	1.651.2
`org.jenkins-ci.main:jenkins-core` Maven	1.652 up to 2.3, plus listed versions 1.6531.6541.6551.6561.657 Show 11 moreShow less 1.6582.02.0-alpha-12.0-alpha-22.0-alpha-32.0-alpha-42.0-beta-12.0-beta-22.0-rc-12.12.2	2.3
`org.jenkins-ci.main:jenkins-core` Maven	before 1.651.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	1.651.2
`jenkins` Red Hat:openshift:3.1::el7 From an advisory covering 7 CVEs	before 0:1.651.2-1.el7	0:1.651.2-1.el7
`jenkins-plugin-openshift-pipeline` Red Hat:openshift:3.1::el7 From an advisory covering 7 CVEs	before 0:1.0.12-1.el7	0:1.0.12-1.el7
`jenkins` Red Hat:openshift:3.2::el7 From an advisory covering 7 CVEs	before 0:1.651.2-1.el7	0:1.651.2-1.el7
`jenkins-plugin-openshift-pipeline` Red Hat:openshift:3.2::el7 From an advisory covering 7 CVEs	before 0:1.0.12-1.el7	0:1.0.12-1.el7
`rhc` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.38.7.1-1.el6op	0:1.38.7.1-1.el6op
`activemq` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:5.9.0-6.redhat.611463.el6op	0:5.9.0-6.redhat.611463.el6op

Show 35 moreShow less

Affected packages
Package	Affected	Fixed
`activemq-client` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:5.9.0-6.redhat.611463.el6op	0:5.9.0-6.redhat.611463.el6op
`openshift-origin-broker` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.16.3.2-1.el6op	0:1.16.3.2-1.el6op
`openshift-origin-broker-util` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.37.6.2-1.el6op	0:1.37.6.2-1.el6op
`rubygem-openshift-origin-admin-console` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.28.2.1-1.el6op	0:1.28.2.1-1.el6op
`rubygem-openshift-origin-controller` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.38.6.4-1.el6op	0:1.38.6.4-1.el6op
`rubygem-openshift-origin-msg-broker-mcollective` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.36.2.4-1.el6op	0:1.36.2.4-1.el6op
`rubygem-openshift-origin-routing-daemon` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:0.26.6.1-1.el6op	0:0.26.6.1-1.el6op
`openshift-origin-cartridge-jbosseap` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:2.27.4.2-1.el6op	0:2.27.4.2-1.el6op
`ImageMagick` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-debuginfo` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-devel` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-doc` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`ImageMagick-perl` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:6.7.2.7-5.el6_8	0:6.7.2.7-5.el6_8
`jenkins` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.651.2-1.el6op	0:1.651.2-1.el6op
`libcgroup` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:0.40.rc1-18.el6_8	0:0.40.rc1-18.el6_8
`libcgroup-debuginfo` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:0.40.rc1-18.el6_8	0:0.40.rc1-18.el6_8
`libcgroup-pam` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:0.40.rc1-18.el6_8	0:0.40.rc1-18.el6_8
`openshift-origin-cartridge-cron` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.25.4.2-1.el6op	0:1.25.4.2-1.el6op
`openshift-origin-cartridge-diy` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.26.2.2-1.el6op	0:1.26.2.2-1.el6op
`openshift-origin-cartridge-haproxy` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.31.6.2-1.el6op	0:1.31.6.2-1.el6op
`openshift-origin-cartridge-jbossews` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.35.5.2-1.el6op	0:1.35.5.2-1.el6op
`openshift-origin-cartridge-jenkins` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.29.2.2-1.el6op	0:1.29.2.2-1.el6op
`openshift-origin-cartridge-jenkins-client` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.26.1.1-1.el6op	0:1.26.1.1-1.el6op
`openshift-origin-cartridge-mongodb` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.26.2.2-1.el6op	0:1.26.2.2-1.el6op
`openshift-origin-cartridge-mysql` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.31.3.3-1.el6op	0:1.31.3.3-1.el6op
`openshift-origin-cartridge-nodejs` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.33.1.2-1.el6op	0:1.33.1.2-1.el6op
`openshift-origin-cartridge-perl` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.30.2.2-1.el6op	0:1.30.2.2-1.el6op
`openshift-origin-cartridge-php` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.35.4.2-1.el6op	0:1.35.4.2-1.el6op
`openshift-origin-cartridge-python` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.34.3.2-1.el6op	0:1.34.3.2-1.el6op
`openshift-origin-cartridge-ruby` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.32.2.2-1.el6op	0:1.32.2.2-1.el6op
`openshift-origin-msg-node-mcollective` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.30.2.2-1.el6op	0:1.30.2.2-1.el6op
`openshift-origin-node-proxy` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.26.3.1-1.el6op	0:1.26.3.1-1.el6op
`openshift-origin-node-util` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.38.7.1-1.el6op	0:1.38.7.1-1.el6op
`rubygem-openshift-origin-frontend-haproxy-sni-proxy` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:0.5.2.1-1.el6op	0:0.5.2.1-1.el6op
`rubygem-openshift-origin-node` Red Hat:openshift:2.0::el6 From an advisory covering 14 CVEs	before 0:1.38.6.4-1.el6op	0:1.38.6.4-1.el6op

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-3724 is a medium vulnerability (CVSS 6.5) in Jenkins, published May 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.3.

References

Show 75 moreShow less

This page doesn't list everything

Left out here: 263 versions. The JSON record has them.