Read the docs
TI-2012-05036 Aliases CVE-2012-6072GHSA-2q8v-qx2x-hxjx

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and…

Priority LOW 24CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Why it matters now

EPSS 0.01825 78th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.main:jenkins-core (Maven): 1.491, 1.480.1Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jenkins-ci.main:jenkins-core (Maven)1.481 to before 1.4911.491Patch availableGHSA-2q8v-qx2x-hxjx
—org.jenkins-ci.main:jenkins-core (Maven)before 1.480.11.480.1Patch availableGHSA-2q8v-qx2x-hxjx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 1.481 to before 1.491 Fixed in 1.491 Patch available GHSA-2q8v-qx2x-hxjx
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 1.480.1 Fixed in 1.480.1 Patch available GHSA-2q8v-qx2x-hxjx

CPE configurations NVD · 68

CPEVersionsRoleVendor
cpe:2.3:a:cloudbees:jenkins:1.447.1.1:-:enterprise:*:*:*:*:*1.447.1.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.447.2.2:-:enterprise:*:*:*:*:*1.447.2.2VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.447.3.1:-:enterprise:*:*:*:*:*1.447.3.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.400:-:lts:*:*:*:*:*1.400VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424:-:lts:*:*:*:*:*1.424VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.447:-:lts:*:*:*:*:*1.447VulnerableCloudBees
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*up to 1.466.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.409.1:*:*:*:*:*:*:*1.409.1VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.409.2:*:*:*:*:*:*:*1.409.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.409.3:*:*:*:*:*:*:*1.409.3VulnerableJenkins
  • cpe:2.3:a:cloudbees:jenkins:1.447.1.1:-:enterprise:*:*:*:*:* Versions 1.447.1.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.447.2.2:-:enterprise:*:*:*:*:* Versions 1.447.2.2 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.447.3.1:-:enterprise:*:*:*:*:* Versions 1.447.3.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.400:-:lts:*:*:*:*:* Versions 1.400 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424:-:lts:*:*:*:*:* Versions 1.424 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.447:-:lts:*:*:*:*:* Versions 1.447 Vulnerable ·CloudBees
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions up to 1.466.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.409.1:*:*:*:*:*:*:* Versions 1.409.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.409.2:*:*:*:*:*:*:* Versions 1.409.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.409.3:*:*:*:*:*:*:* Versions 1.409.3 Vulnerable ·Jenkins
Show 58 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jenkins:jenkins:1.424.1:*:*:*:*:*:*:*1.424.1VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.2:*:*:*:*:*:*:*1.424.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.3:*:*:*:*:*:*:*1.424.3VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.4:*:*:*:*:*:*:*1.424.4VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.5:*:*:*:*:*:*:*1.424.5VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424.6:*:*:*:*:*:*:*1.424.6VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.447.1:*:*:*:*:*:*:*1.447.1VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.447.2:*:*:*:*:*:*:*1.447.2VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.466.1:*:*:*:*:*:*:*1.466.1VulnerableJenkins
cpe:2.3:a:cloudbees:jenkins:1.466.1.2:-:enterprise:*:*:*:*:*1.466.1.2VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.466.2.1:-:enterprise:*:*:*:*:*1.466.2.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:*:*:*:*:*:*:*:*up to 1.480.3.1VulnerableCloudBees
cpe:2.3:a:jenkins:jenkins:1.400:*:*:*:*:*:*:*1.400VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.401:*:*:*:*:*:*:*1.401VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.402:*:*:*:*:*:*:*1.402VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.403:*:*:*:*:*:*:*1.403VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.404:*:*:*:*:*:*:*1.404VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.405:*:*:*:*:*:*:*1.405VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.406:*:*:*:*:*:*:*1.406VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.407:*:*:*:*:*:*:*1.407VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.408:*:*:*:*:*:*:*1.408VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.409:*:*:*:*:*:*:*1.409VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.410:*:*:*:*:*:*:*1.410VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.411:*:*:*:*:*:*:*1.411VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.412:*:*:*:*:*:*:*1.412VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.413:*:*:*:*:*:*:*1.413VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.414:*:*:*:*:*:*:*1.414VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.415:*:*:*:*:*:*:*1.415VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.416:*:*:*:*:*:*:*1.416VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.417:*:*:*:*:*:*:*1.417VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.418:*:*:*:*:*:*:*1.418VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.419:*:*:*:*:*:*:*1.419VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.420:*:*:*:*:*:*:*1.420VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.421:*:*:*:*:*:*:*1.421VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.422:*:*:*:*:*:*:*1.422VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.423:*:*:*:*:*:*:*1.423VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.424:*:*:*:*:*:*:*1.424VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.425:*:*:*:*:*:*:*1.425VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.426:*:*:*:*:*:*:*1.426VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.427:*:*:*:*:*:*:*1.427VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.428:*:*:*:*:*:*:*1.428VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.429:*:*:*:*:*:*:*1.429VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.430:*:*:*:*:*:*:*1.430VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.431:*:*:*:*:*:*:*1.431VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.432:*:*:*:*:*:*:*1.432VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.433:*:*:*:*:*:*:*1.433VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.434:*:*:*:*:*:*:*1.434VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.435:*:*:*:*:*:*:*1.435VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.436:*:*:*:*:*:*:*1.436VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:1.437:*:*:*:*:*:*:*1.437VulnerableJenkins
cpe:2.3:a:cloudbees:jenkins:1.424.0.2:-:enterprise:*:*:*:*:*1.424.0.2VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424.0.4:-:enterprise:*:*:*:*:*1.424.0.4VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424.1.1:-:enterprise:*:*:*:*:*1.424.1.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424.2.1:-:enterprise:*:*:*:*:*1.424.2.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424.4.1:-:enterprise:*:*:*:*:*1.424.4.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424.5.1:-:enterprise:*:*:*:*:*1.424.5.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424.6.1:-:enterprise:*:*:*:*:*1.424.6.1VulnerableCloudBees
cpe:2.3:a:cloudbees:jenkins:1.424.6.11:-:enterprise:*:*:*:*:*1.424.6.11VulnerableCloudBees
  • cpe:2.3:a:jenkins:jenkins:1.424.1:*:*:*:*:*:*:* Versions 1.424.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.2:*:*:*:*:*:*:* Versions 1.424.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.3:*:*:*:*:*:*:* Versions 1.424.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.4:*:*:*:*:*:*:* Versions 1.424.4 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.5:*:*:*:*:*:*:* Versions 1.424.5 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424.6:*:*:*:*:*:*:* Versions 1.424.6 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.447.1:*:*:*:*:*:*:* Versions 1.447.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.447.2:*:*:*:*:*:*:* Versions 1.447.2 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.466.1:*:*:*:*:*:*:* Versions 1.466.1 Vulnerable ·Jenkins
  • cpe:2.3:a:cloudbees:jenkins:1.466.1.2:-:enterprise:*:*:*:*:* Versions 1.466.1.2 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.466.2.1:-:enterprise:*:*:*:*:* Versions 1.466.2.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:*:*:*:*:*:*:*:* Versions up to 1.480.3.1 Vulnerable ·CloudBees
  • cpe:2.3:a:jenkins:jenkins:1.400:*:*:*:*:*:*:* Versions 1.400 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.401:*:*:*:*:*:*:* Versions 1.401 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.402:*:*:*:*:*:*:* Versions 1.402 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.403:*:*:*:*:*:*:* Versions 1.403 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.404:*:*:*:*:*:*:* Versions 1.404 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.405:*:*:*:*:*:*:* Versions 1.405 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.406:*:*:*:*:*:*:* Versions 1.406 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.407:*:*:*:*:*:*:* Versions 1.407 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.408:*:*:*:*:*:*:* Versions 1.408 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.409:*:*:*:*:*:*:* Versions 1.409 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.410:*:*:*:*:*:*:* Versions 1.410 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.411:*:*:*:*:*:*:* Versions 1.411 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.412:*:*:*:*:*:*:* Versions 1.412 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.413:*:*:*:*:*:*:* Versions 1.413 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.414:*:*:*:*:*:*:* Versions 1.414 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.415:*:*:*:*:*:*:* Versions 1.415 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.416:*:*:*:*:*:*:* Versions 1.416 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.417:*:*:*:*:*:*:* Versions 1.417 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.418:*:*:*:*:*:*:* Versions 1.418 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.419:*:*:*:*:*:*:* Versions 1.419 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.420:*:*:*:*:*:*:* Versions 1.420 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.421:*:*:*:*:*:*:* Versions 1.421 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.422:*:*:*:*:*:*:* Versions 1.422 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.423:*:*:*:*:*:*:* Versions 1.423 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.424:*:*:*:*:*:*:* Versions 1.424 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.425:*:*:*:*:*:*:* Versions 1.425 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.426:*:*:*:*:*:*:* Versions 1.426 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.427:*:*:*:*:*:*:* Versions 1.427 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.428:*:*:*:*:*:*:* Versions 1.428 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.429:*:*:*:*:*:*:* Versions 1.429 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.430:*:*:*:*:*:*:* Versions 1.430 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.431:*:*:*:*:*:*:* Versions 1.431 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.432:*:*:*:*:*:*:* Versions 1.432 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.433:*:*:*:*:*:*:* Versions 1.433 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.434:*:*:*:*:*:*:* Versions 1.434 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.435:*:*:*:*:*:*:* Versions 1.435 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.436:*:*:*:*:*:*:* Versions 1.436 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:1.437:*:*:*:*:*:*:* Versions 1.437 Vulnerable ·Jenkins
  • cpe:2.3:a:cloudbees:jenkins:1.424.0.2:-:enterprise:*:*:*:*:* Versions 1.424.0.2 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424.0.4:-:enterprise:*:*:*:*:* Versions 1.424.0.4 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424.1.1:-:enterprise:*:*:*:*:* Versions 1.424.1.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424.2.1:-:enterprise:*:*:*:*:* Versions 1.424.2.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424.4.1:-:enterprise:*:*:*:*:* Versions 1.424.4.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424.5.1:-:enterprise:*:*:*:*:* Versions 1.424.5.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424.6.1:-:enterprise:*:*:*:*:* Versions 1.424.6.1 Vulnerable ·CloudBees
  • cpe:2.3:a:cloudbees:jenkins:1.424.6.11:-:enterprise:*:*:*:*:* Versions 1.424.6.11 Vulnerable ·CloudBees

Remediation

  • Fix · GHSA-2q8v-qx2x-hxjx org.jenkins-ci.main:jenkins-core (Maven) Fixed in 1.491 Advisory →
  • Fix · GHSA-2q8v-qx2x-hxjx org.jenkins-ci.main:jenkins-core (Maven) Fixed in 1.480.1 Advisory →

Red Hat 1 advisory

  • RHSA-2013:0220 Released 2013-01-31 · Red Hat rating Important
    Red Hat OpenShift Enterprise 1.1 update
    • Red Hat OpenShift Enterprise Client Tools rhc-1.3.2-1.3.el6op
    • Red Hat OpenShift Enterprise Infrastructure libmongodb-2.0.2-6.el6op, mongodb-2.0.2-6.el6op, mongodb-devel-2.0.2-6.el6op +20
    • Red Hat OpenShift Enterprise Node jenkins-1.498-1.1.el6op, openshift-origin-cartridge-haproxy-1.4-1.0.3-1.el6op, openshift-origin-cartridge-ruby-1.8-1.0.5-1.el6op +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Enterprise Client ToolsFixed RHSA-2013:0220
Red Hat OpenShift Enterprise InfrastructureFixed RHSA-2013:0220
Red Hat OpenShift Enterprise NodeFixed RHSA-2013:0220

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-6072
  2. 2026-10-03 Alias added: GHSA-2q8v-qx2x-hxjx

References

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences