{"id":"CVE-2012-6072","aliases":["EUVD-2012-5946","GHSA-2q8v-qx2x-hxjx","RHSA-2013:0220"],"status":"published","title":"Jenkins allows HTTP Injection and Response Splitting","description":"CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01825,"percentile":0.78948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-113","CWE-20"],"published":"2013-02-24T22:00:00Z","modified":"2026-06-28T10:07:21Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["1.491","1.480.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.481"},{"fixed":"1.491"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.480.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.481"},{"fixed":"1.491"}]}],"versions":["1.481","1.482","1.483","1.484","1.485","1.486","1.487","1.488","1.489","1.490"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.480.1"}]}],"versions":["1.396","1.397","1.398","1.399","1.400","1.401","1.403","1.404","1.405","1.406","1.407","1.408","1.409","1.409.1","1.409.2","1.409.3","1.410","1.411","1.412","1.413","1.414","1.415","1.416","1.417","1.418","1.419","1.420","1.421","1.422","1.423","1.424","1.424.1","1.424.2","1.424.3","1.424.4","1.424.5","1.424.6","1.425","1.426","1.427","1.428","1.429","1.430","1.431","1.432","1.433","1.434","1.435","1.436","1.437","1.438","1.439","1.440","1.441","1.442","1.443","1.444","1.445","1.446","1.447","1.447.1","1.447.2","1.448","1.449","1.450","1.451","1.452","1.453","1.454","1.455","1.456","1.457","1.458","1.459","1.460","1.461","1.462","1.463","1.464","1.465","1.466","1.466.1","1.466.2","1.467","1.468","1.469","1.470","1.471","1.472","1.473","1.474","1.475","1.476","1.477","1.478","1.479","1.480"]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rhc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.2-1.3.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"libmongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-6.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-6.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-6.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"mongodb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-6.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-6.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.13-2.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.10-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-broker-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.14-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-mod_passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.12-21.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-2.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-2.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.12-21.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-passenger-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.12-21.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-passenger-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.12-21.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-passenger-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.12-21.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-passenger-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.12-21.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"ruby193-rubygem-passenger-native-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.12-21.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.13-3.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-auth-remote-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-2.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-console-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.11-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-dns-bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-msg-broker-mcollective","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.4-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.498-1.1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-cartridge-haproxy-1.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-cartridge-ruby-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-cartridge-ruby-1.9-scl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-msg-node-mcollective","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-node-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"openshift-origin-port-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-1.el6op"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-openshift-origin-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.10-6.el6op"}]}],"bundled":7}],"products":[{"vendor":"cloudbees","product":"jenkins"},{"vendor":"jenkins","product":"jenkins"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0220.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=890607","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6072","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2q8v-qx2x-hxjx"},{"url":"https://github.com/jenkinsci/jenkins","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0220","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04","tags":["article"]},{"url":"https://access.redhat.com/knowledge/docs/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=855264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=864921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=872415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873768","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874511","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874845","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=875657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=876324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=876465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=876644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=876937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=876939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=877158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=877407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=885587","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=885598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=886159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=888043","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=888056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=888671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=890608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=890612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=893288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=893307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=893895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=896406","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0220.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5658","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6072","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6073","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6073","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6074","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6074","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6496","tags":["advisory"]},{"url":"http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0158","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0164","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0164","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-6072","description":"CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.","status":"published","published":"2013-02-24T22:00:00Z","modified":"2024-08-06T21:21:28.396Z","updated_at":"2026-11-02T14:34:51.269982Z"}],"euvd":[{"id":"EUVD-2012-5946","description":"CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.","status":"published","published":"2013-02-24T22:00:00Z","modified":"2024-08-06T21:21:28Z","updated_at":"2026-11-03T01:56:02.968969Z"}],"ghsa":[{"id":"GHSA-2q8v-qx2x-hxjx","title":"Jenkins allows HTTP Injection and Response Splitting","description":"CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.","status":"published","published":"2022-05-14T02:13:37Z","modified":"2025-03-13T17:57:25Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20","CWE-113"],"updated_at":"2026-11-02T14:38:34.992855Z"}],"nvd":[{"id":"CVE-2012-6072","description":"CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.","status":"published","published":"2013-02-24T22:55:01.097Z","modified":"2026-06-16T23:47:46.343Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"GHSA-2q8v-qx2x-hxjx","title":"Jenkins allows HTTP Injection and Response Splitting","description":"CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.","status":"published","published":"2022-05-14T02:13:37Z","modified":"2025-03-13T18:40:18.972097Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-113","CWE-20"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"RHSA-2013:0220","title":"Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1 update","status":"published","published":"2024-09-15T20:30:43Z","modified":"2026-06-28T10:07:21Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}