Miggo Logo
Miggo Vulnerability Database
→
CVE-2015-5322

CVE-2015-5322:
Jenkins has Local File Inclusion Vulnerability

5

CVSS Score

Basic Information

CVE ID
CVE-2015-5322
GHSA ID
GHSA-89vc-7frq-2rfj
EPSS Score
0.45787%
CWE
CWE-22
Published
5/13/2022
Updated
3/13/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.main:jenkins-coremaven>= 1.626, < 1.6381.638
org.jenkins-ci.main:jenkins-coremaven< 1.625.21.625.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from improper path validation in jnlpJars requests. The commit diff shows a security check for '..' was added to JnlpJarURLConnection.getURL() in Slave.java. Prior to this patch, the function would naively concatenate user-controlled 'fileName' with '/WEB-INF/' without validation, enabling path traversal. The added check explicitly prevents directory traversal, confirming this was the vulnerable code path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ir**tory tr*v*rs*l vuln*r**ility in J*nkins ***or* *.*** *n* LTS ***or* *.***.* *llows r*mot* *tt**k*rs to list *ir**tory *ont*nts *n* r*** *r*itr*ry *il*s in t** J*nkins s*rvl*t r*sour**s vi* *ir**tory tr*v*rs*l s*qu*n**s in * r*qu*st to jnlpJ*rs/.

Reasoning

T** vuln*r**ility st*mm** *rom improp*r p*t* v*li**tion in `jnlpJ*rs` r*qu*sts. T** *ommit *i** s*ows * s**urity ****k *or '..' w*s ***** to `JnlpJ*rURL*onn**tion.**tURL()` in `Sl*v*.j*v*`. Prior to t*is p*t**, t** *un*tion woul* n*iv*ly *on**t*n*t*