---
title: "Jenkins Fingerprints disclosure (CVE-2015-5317)"
canonical: https://trickest.com/library/cve-2015-5317-jenkins-fingerprints-info-disclosure
description: "Flag Jenkins hosts for CVE-2015-5317 by reading the version from the default response. Floors 1.638 / 1.625.2. No Fingerprints browse."
---

# Jenkins Fingerprints disclosure (CVE-2015-5317)

## Overview

This workflow finds Jenkins and sorts each host by whether its version falls below the CVE-2015-5317 fixed floors. CVE-2015-5317 is unauthenticated information disclosure through Fingerprints pages on vulnerable Jenkins builds. This check never browses the Fingerprints UI and never exercises a write path. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints Jenkins from the product default response and version banner, parses the version, and compares it to the weekly and LTS floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when CI controllers turn over. A restored weekly build that still sits under 1.638 is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fetch each host and fingerprint Jenkins from the product default response and version banner.
3. Parse the version and compare it to the CVE-2015-5317 floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Jenkins was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated fingerprint of the product default response and version banner only. No Fingerprints page browse and no write path.

## Sample output

The records below are illustrative and do not come from a real run. They show one Jenkins host below a CVE-2015-5317 floor, one at or above its line floor, and one host that is not the product.

```jsonl
{"url": "https://ci.example.com", "is_product": true, "product_version": "1.637", "vulnerable": true, "detail": "below weekly floor 1.638"}
{"url": "https://ci.example.org", "is_product": true, "product_version": "1.625.2", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Jenkins"}
```

```json
{"cve": "CVE-2015-5317", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Jenkins versions does this flag?

Builds below the floors in the graph: 1.638 on the weekly line and 1.625.2 on the LTS 1.625.x line. A version picks the matching line, then compares to that line floor. The compare uses the version the default response and banner themselves served.

### Does an affected row mean Fingerprints disclosure worked?

No. The check only fingerprints Jenkins and reads the version. It does not open Fingerprints pages, does not authenticate, and does not confirm disclosure.

### Is this check safe on production?

Yes. It is a read-only unauthenticated HTTP fingerprint of the public product response. It does not write job or fingerprint data.

### Does the check need credentials?

No. It fingerprints the public default response the way an external scanner would.

### What is CVE-2015-5317?

Unauthenticated information disclosure via Fingerprints pages on vulnerable Jenkins builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Jenkins CLI File Read (CVE-2024-23897)](/library/jenkins-path-traversal-check-cve-2024-23897). Reach for it when the next Jenkins finding is an unauthenticated CLI file read.
- [Jenkins Stapler RCE (CVE-2018-1000861)](/library/cve-2018-1000861-jenkins-stapler-deserialization-rce). Reach for it when you need a Stapler deserialization check on the same Jenkins hosts.
- [TeamCity Auth Bypass (CVE-2024-27199)](/library/jetbrains-teamcity-auth-bypass-cve-2024-27199). Reach for it when the next CI host is TeamCity, not Jenkins.

---
_Markdown source of https://trickest.com/library/cve-2015-5317-jenkins-fingerprints-info-disclosure._