CVE-2016-3725: Jenkins

Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days.

Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).

Affected products

• Jenkins Jenkins: up to and including 1.651.1; up to and including 2.2
• Red Hat Openshift: version 3.1 only; version 3.2 only

Published 2016-05-17. Last modified 2026-06-17.