CVE-2015-5319: XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS befor...

Security readout for executives and security teams

Older Jenkins versions could let a remote attacker place malicious XML in a job configuration, causing XML-aware Jenkins tooling to read local files. The bundle does not provide CVSS, KEV status, or active exploitation evidence, but arbitrary file read in CI infrastructure can expose secrets and build credentials. Exposure is most likely in Jenkins installations older than 1.638, or Jenkins LTS older than 1.625.2, where CLI-based job creation or job configuration import workflows are used. Prioritize remediation for internet-facing or shared Jenkins environments because CI systems often hold credentials, source access, and deployment trust. Legacy internal-only instances still merit cleanup during vulnerability management cycles. Mitigation focus: Upgrade Jenkins to 1.638 or later.; Upgrade Jenkins LTS to 1.625.2 or later.; Use vendor-supported Red Hat Jenkins packages where applicable..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.