CVE-2014-3661
published 2014-10-16CVE-2014-3661: Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
PriorityP420medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
1.84%
78.8th percentile
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | certain_pages_in_monitoring_plugin | — | — |
| jenkins | jenkins | <= 1.582 | — |
| jenkins | jenkins | <= 1.565.2 | — |
| jenkins | jenkins_core | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | user_of_monitoring_plugin | — | — |
| redhat | openshift | <= 3.1 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins: denial of service (SECURITY-87)
vendor_redhat·2014-10-02·CVSS 5.0
CVE-2014-3661 [MEDIUM] CWE-400 jenkins: denial of service (SECURITY-87)
jenkins: denial of service (SECURITY-87)
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
Package: jenkins (OpenShift Enterprise 1) - Will not fix
Jenkins
Jenkins Security Advisory 2014-10-01
vendor_jenkins·2014-10-01·CVSS 5.0
CVE-2013-2186 [MEDIUM] Jenkins Security Advisory 2014-10-01
Title: Jenkins Security Advisory 2014-10-01
Jenkins Security Advisory 2014-10-01
This advisory announces:
multiple security vulnerabilities that were found in Jenkins core.
two security vulnerabilities found in the monitoring plugin
Description
SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)
This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.
SECURITY-110/CVE-2014-3662 (User name discovery)
Anonymous users can test if the user of a specific name exists or not through login attempts.
SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)
An user with a permission limited to Job/CONF
GHSA
Jenkins Denial of Service vulnerability
ghsa·2022-05-17
CVE-2014-3661 [MEDIUM] Jenkins Denial of Service vulnerability
Jenkins Denial of Service vulnerability
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
OSV
Jenkins Denial of Service vulnerability
osv·2022-05-17
CVE-2014-3661 [MEDIUM] Jenkins Denial of Service vulnerability
Jenkins Denial of Service vulnerability
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
No detection rules found.
No public exploits indexed.
2014-10-16
Published