VYPR
Get started
← All advisories
High severity8.8NVD Advisory· Published Feb 3, 2016· Updated May 6, 2026

CVE-2015-7537

CVE-2015-7537

Description

Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.main:jenkins-coreMaven
>= 1.626, < 1.6401.640
org.jenkins-ci.main:jenkins-coreMaven
< 1.625.21.625.2

Affected products

4
  • Jenkins/Jenkins2 versions
    cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*range: <=1.639
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <=1.625.1
  • Red Hat/Openshift2 versions
    cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*range: <=3.1

Patches

1
40a28999e221

[FIX SECURITY-225] Add RequirePOST annotations

https://github.com/jenkinsci/jenkinsDaniel BeckNov 15, 2015via ghsa
commit
3 files changed · +6 −0
  • core/src/main/java/hudson/logging/LogRecorderManager.java+2 −0 modified
    @@ -40,6 +40,7 @@
 import org.kohsuke.stapler.StaplerResponse;
 import org.kohsuke.stapler.HttpResponse;
 import org.kohsuke.stapler.HttpRedirect;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import javax.servlet.ServletException;
 import java.io.File;
@@ -106,6 +107,7 @@ public void load() throws IOException {
     /**
      * Creates a new log recorder.
      */
+    @RequirePOST
     public HttpResponse doNewLogRecorder(@QueryParameter String name) {
         Jenkins.checkGoodName(name);
  • core/src/main/java/hudson/model/AbstractProject.java+1 −0 modified
    @@ -1924,6 +1924,7 @@ public DirectoryBrowserSupport doWs( StaplerRequest req, StaplerResponse rsp ) t
     /**
      * Wipes out the workspace.
      */
+    @RequirePOST
     public HttpResponse doDoWipeOutWorkspace() throws IOException, ServletException, InterruptedException {
         checkPermission(Functions.isWipeOutPermissionEnabled() ? WIPEOUT : BUILD);
         R b = getSomeBuildWithWorkspace();
  • core/src/main/java/hudson/PluginManager.java+3 −0 modified
    @@ -809,6 +809,7 @@ public void doInstall(StaplerRequest req, StaplerResponse rsp) throws IOExceptio
     /**
      * Bare-minimum configuration mechanism to change the update center.
      */
+    @RequirePOST
     public HttpResponse doSiteConfigure(@QueryParameter String site) throws IOException {
         Jenkins hudson = Jenkins.getInstance();
         hudson.checkPermission(CONFIGURE_UPDATECENTER);
@@ -824,6 +825,7 @@ public HttpResponse doSiteConfigure(@QueryParameter String site) throws IOExcept
     }
 
 
+    @RequirePOST
     public HttpResponse doProxyConfigure(StaplerRequest req) throws IOException, ServletException {
         Jenkins jenkins = Jenkins.getInstance();
         jenkins.checkPermission(CONFIGURE_UPDATECENTER);
@@ -842,6 +844,7 @@ public HttpResponse doProxyConfigure(StaplerRequest req) throws IOException, Ser
     /**
      * Uploads a plugin.
      */
+    @RequirePOST
     public HttpResponse doUploadPlugin(StaplerRequest req) throws IOException, ServletException {
         try {
             Jenkins.getInstance().checkPermission(UPLOAD_PLUGINS);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.