CVE-2015-7536: Cross-Site Scripting Vulnerability in org.jenkins-ci.main:jenkins-core
Summary
CVE-2015-7536: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.625.2
>= 1.626, < 1.640
Fixed in 1.625.2 or 1.640, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.jenkins-ci.main:jenkins-core is a Maven package that provides the core functionality of Jenkins, an open-source automation server. Jenkins is widely used for continuous integration and delivery of software projects. This package is responsible for managing workspaces and archived artifacts in Jenkins. It is a critical component for the proper functioning of the server.
Vulnerability Detail
The vulnerability identified as CVE-2015-7536 is a cross-site scripting (XSS) vulnerability in Jenkins versions before 1.640 and LTS before 1.625.2. It allows remote authenticated users to inject arbitrary web script or HTML into the application. The specific vectors related to workspaces and archived artifacts are not disclosed. This vulnerability can be exploited by attackers to execute malicious code within the context of the affected user's browser, potentially leading to session hijacking, data theft, or other unauthorized actions.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.625.21.625.2 -
>= 1.626, < 1.6401.640
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workaround is provided for this vulnerability. It is essential to apply the recommended fix by upgrading Jenkins to the latest version.
Conclusion
The cross-site scripting vulnerability (CVE-2015-7536) in org.jenkins-ci.main:jenkins-core poses a moderate risk to Jenkins installations. Upgrading to Jenkins version 1.640 or later is crucial to mitigate this vulnerability. It is recommended to regularly check for open-source vulnerabilities using tools like Vulert to ensure the security of your software projects. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
This vulnerability allows remote authenticated users to inject malicious code into Jenkins, potentially leading to various security risks such as session hijacking, data theft, or unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including CVE-2015-7536, are detected.
Specific exploits for this vulnerability are not disclosed. However, as it is a well-known and documented vulnerability, it is possible that attackers have developed exploits targeting this vulnerability. It is crucial to apply the recommended fix to mitigate the risk.
Yes, this vulnerability can be exploited remotely by authenticated users. Attackers can inject malicious code into Jenkins through the specified vectors, potentially compromising the security of the system.
There is no specific evidence of active exploitation of this vulnerability mentioned in the available information. However, it is always recommended to apply security patches promptly to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
