CVE-2015-5318: Jenkins

Medium severity, CVSS 6.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.

Affected products

• Jenkins Jenkins: up to and including 1.637; up to and including 1.625.1
• Red Hat Openshift: up to and including 3.1; version 2.0 only

Published 2015-11-25. Last modified 2026-06-17.