Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-0789

CVE-2016-0789: Jenkins has CRLF Injection Vulnerability in the CLI

6.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2016-0789
GHSA ID
GHSA-8p3c-m625-wh83
EPSS Score
0.44089%
CWE
CWE-20
Published
5/14/2022
Updated
3/13/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.main:jenkins-coremaven>= 1.643, < 1.6501.650
org.jenkins-ci.main:jenkins-coremaven< 1.642.21.642.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from directly embedding user-controlled input (commandName) in HTTP error responses without proper sanitization. The patch removes the commandName parameter from the error message, indicating this was the injection vector. The sendError method call with unsanitized input creates HTTP response splitting opportunities when commandName contains CRLF sequences to inject headers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*RL* inj**tion vuln*r**ility in t** *LI *omm*n* *o*um*nt*tion in J*nkins ***or* *.*** *n* LTS ***or* *.***.* *llows r*mot* *tt**k*rs to inj**t *r*itr*ry *TTP *****rs *n* *on*u*t *TTP r*spons* splittin* *tt**ks vi* unsp**i*i** v**tors.

Reasoning

T** vuln*r**ility st*ms *rom *ir**tly *m****in* us*r-*ontroll** input (*omm*n*N*m*) in *TTP *rror r*spons*s wit*out prop*r s*nitiz*tion. T** p*t** r*mov*s t** *omm*n*N*m* p*r*m*t*r *rom t** *rror m*ss***, in*i**tin* t*is w*s t** inj**tion v**tor. T**