CVE-2012-6072
Jenkins allows HTTP Injection and Response Splitting
CVE-2012-6072 is a medium vulnerability (CVSS 4.3) in Cloudbees Jenkins, published February 24, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 79th percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.491.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.82%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.491org.jenkins-ci.main:jenkins-core +37 more
Description
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | 1.481 up to 1.491 | 1.491 |
org.jenkins-ci.main:jenkins-coreMaven | before 1.480.1 | 1.480.1 |
org.jenkins-ci.main:jenkins-coreMaven | 1.481 up to 1.491, plus listed versions 1.4821.4831.4841.4851.486 Show 4 moreShow less1.4871.4881.4891.490 | 1.491 |
org.jenkins-ci.main:jenkins-coreMaven | before 1.480.1, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 | 1.480.1 |
rhcRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.3.2-1.3.el6op | 0:1.3.2-1.3.el6op |
libmongodbRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodbRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodb-debuginfoRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodb-develRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodb-serverRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openshift-consoleRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:0.0.13-2.el6op | 0:0.0.13-2.el6op |
openshift-origin-brokerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.10-1.el6op | 0:1.0.10-1.el6op |
openshift-origin-broker-utilRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.14-1.el6op | 0:1.0.14-1.el6op |
ruby193-mod_passengerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-activerecordRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 1:3.2.8-2.el6 | 1:3.2.8-2.el6 |
ruby193-rubygem-activerecord-docRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 1:3.2.8-2.el6 | 1:3.2.8-2.el6 |
ruby193-rubygem-passengerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-debuginfoRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-develRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-docRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-nativeRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-native-libsRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
rubygem-activerecordRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 1:3.0.13-3.el6op | 1:3.0.13-3.el6op |
rubygem-openshift-origin-auth-remote-userRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.4-2.el6op | 0:1.0.4-2.el6op |
rubygem-openshift-origin-commonRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
rubygem-openshift-origin-consoleRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.6-1.el6op | 0:1.0.6-1.el6op |
rubygem-openshift-origin-console-docRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.6-1.el6op | 0:1.0.6-1.el6op |
rubygem-openshift-origin-controllerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.11-1.el6op | 0:1.0.11-1.el6op |
rubygem-openshift-origin-dns-bindRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
rubygem-openshift-origin-msg-broker-mcollectiveRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.4-1.el6op | 0:1.0.4-1.el6op |
jenkinsRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.498-1.1.el6op | 0:1.498-1.1.el6op |
openshift-origin-cartridge-haproxy-1.4Red Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-ruby-1.8Red Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-cartridge-ruby-1.9-sclRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-msg-node-mcollectiveRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
openshift-origin-node-utilRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.7-1.el6op | 0:1.0.7-1.el6op |
openshift-origin-port-proxyRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
rubygem-openshift-origin-nodeRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.10-6.el6op | 0:1.0.10-6.el6op |
What each source reports
NVD Score used
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- Record
CVE-2012-6072- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- Record
CVE-2012-6072- Updated
- 2026-11-02
EUVDEUVD-2012-5946No score
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- Record
EUVD-2012-5946- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2q8v-qx2x-hxjx
Jenkins allows HTTP Injection and Response Splitting
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- Record
GHSA-2q8v-qx2x-hxjx- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-113
- Updated
- 2026-11-02
OSVGHSA-2q8v-qx2x-hxjx
Jenkins allows HTTP Injection and Response Splitting
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- Record
GHSA-2q8v-qx2x-hxjx- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-113, CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2013-0220.html
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20
bugzilla.redhat.com/show_bug.cgi?id=890607
cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
nvd.nist.gov/vuln/detail/CVE-2012-6072
github.com/advisories/GHSA-2q8v-qx2x-hxjx
Show 67 moreShow less
access.redhat.com/errata/RHSA-2013:0220
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0220.json
cve.org/CVERecord?id=CVE-2012-5658
phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html
Left out here: 47 versions. The JSON record has them.