CVE-2014-3664
published 2014-10-15CVE-2014-3664: Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read…
PriorityP423medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
2.47%
82.8th percentile
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | certain_pages_in_monitoring_plugin | — | — |
| jenkins | jenkins | <= 1.565.2 | — |
| jenkins | jenkins | <= 1.582 | — |
| jenkins | jenkins_core | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | user_of_monitoring_plugin | — | — |
| redhat | openshift | <= 3.1 | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins: directory traversal flaw (SECURITY-131)
vendor_redhat·2014-10-02·CVSS 4.0
CVE-2014-3664 [MEDIUM] CWE-22 jenkins: directory traversal flaw (SECURITY-131)
jenkins: directory traversal flaw (SECURITY-131)
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
Package: jenkins (OpenShift Enterprise 1) - Will not fix
Jenkins
Jenkins Security Advisory 2014-10-01
vendor_jenkins·2014-10-01·CVSS 5.0
CVE-2013-2186 [MEDIUM] Jenkins Security Advisory 2014-10-01
Title: Jenkins Security Advisory 2014-10-01
Jenkins Security Advisory 2014-10-01
This advisory announces:
multiple security vulnerabilities that were found in Jenkins core.
two security vulnerabilities found in the monitoring plugin
Description
SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)
This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.
SECURITY-110/CVE-2014-3662 (User name discovery)
Anonymous users can test if the user of a specific name exists or not through login attempts.
SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)
An user with a permission limited to Job/CONF
GHSA
Jenkins Path Traversal vulnerability
ghsa·2022-05-17
CVE-2014-3664 [MEDIUM] CWE-22 Jenkins Path Traversal vulnerability
Jenkins Path Traversal vulnerability
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
OSV
Jenkins Path Traversal vulnerability
osv·2022-05-17
CVE-2014-3664 [MEDIUM] Jenkins Path Traversal vulnerability
Jenkins Path Traversal vulnerability
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2016:0070https://bugzilla.redhat.com/show_bug.cgi?id=1147765https://exchange.xforce.ibmcloud.com/vulnerabilities/96973https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01https://access.redhat.com/errata/RHSA-2016:0070https://bugzilla.redhat.com/show_bug.cgi?id=1147765https://exchange.xforce.ibmcloud.com/vulnerabilities/96973https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
2014-10-15
Published