CVE-2015-5325: Jenkins allows Bypass of Access Restrictions

May 13, 2022 (updated October 31, 2025)

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.

References

access.redhat.com/errata/RHSA-2016:0070
github.com/advisories/GHSA-x2q2-8pwq-fr5r
github.com/jenkinsci/jenkins
github.com/jenkinsci/jenkins/commit/054a329c59171ca12ff98f7063ce7fd053ee08bf
nvd.nist.gov/vuln/detail/CVE-2015-5325
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Code Behaviors & Features

Detect and mitigate CVE-2015-5325 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →