CVE-2016-3723: Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensi...

Security readout for executives and security teams

CVE-2016-3723 is a Jenkins information disclosure flaw. In affected Jenkins versions, a logged-in user with read access could obtain sensitive plugin installation information through XML or JSON API endpoints missing permission checks. Exposure is most likely in older Jenkins or Jenkins LTS deployments where authenticated users have read access. Internet exposure increases concern, but the sources only establish authenticated read-access abuse. Prioritize remediation for legacy Jenkins systems with many users or external reachability. The issue is authenticated information disclosure, so urgency is below unauthenticated compromise but meaningful for CI/CD environments. Mitigation focus: Upgrade Jenkins to 2.3, LTS 1.651.2, or a later supported release.; Review the Jenkins and CloudBees advisory for vendor-specific upgrade guidance.; Apply relevant Red Hat security errata if using Red Hat packaged Jenkins..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.