CVE-2015-5318: Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

May 13, 2022 (updated October 31, 2025)

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.

References

access.redhat.com/errata/RHSA-2016:0070
github.com/advisories/GHSA-3wmv-7php-rhg5
github.com/jenkinsci/jenkins
github.com/jenkinsci/jenkins/commit/f53802bb82a25b295b6dfa3bf2a591a6c8552183
nvd.nist.gov/vuln/detail/CVE-2015-5318
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Code Behaviors & Features

Detect and mitigate CVE-2015-5318 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →