CVE-2015-5319: Jenkins

Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days.

XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.

Affected products

• Jenkins Jenkins: up to and including 1.625.1; up to and including 1.637
• Red Hat Openshift: up to and including 3.1; version 2.0 only

Published 2015-11-25. Last modified 2026-06-17.