Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-3721.json"