CVE-2014-3667
published 2014-10-16CVE-2014-3667: Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ…
PriorityP417medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
1.36%
68.9th percentile
Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | certain_pages_in_monitoring_plugin | — | — |
| jenkins | jenkins | <= 1.582 | — |
| jenkins | jenkins | <= 1.565.2 | — |
| jenkins | jenkins_core | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | user_of_monitoring_plugin | — | — |
| redhat | openshift | <= 3.1 | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins: plug-in code can be downloaded by anyone with read access (SECURITY-155)
vendor_redhat·2014-10-02·CVSS 4.0
CVE-2014-3667 [MEDIUM] CWE-285 jenkins: plug-in code can be downloaded by anyone with read access (SECURITY-155)
jenkins: plug-in code can be downloaded by anyone with read access (SECURITY-155)
Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
Package: jenkins (OpenShift Enterprise 1) - Affected
Jenkins
Jenkins Security Advisory 2014-10-01
vendor_jenkins·2014-10-01·CVSS 5.0
CVE-2013-2186 [MEDIUM] Jenkins Security Advisory 2014-10-01
Title: Jenkins Security Advisory 2014-10-01
Jenkins Security Advisory 2014-10-01
This advisory announces:
multiple security vulnerabilities that were found in Jenkins core.
two security vulnerabilities found in the monitoring plugin
Description
SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)
This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.
SECURITY-110/CVE-2014-3662 (User name discovery)
Anonymous users can test if the user of a specific name exists or not through login attempts.
SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)
An user with a permission limited to Job/CONF
GHSA
Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code
ghsa·2022-05-17
CVE-2014-3667 [MEDIUM] CWE-200 Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code
Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code
Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
OSV
Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code
osv·2022-05-17
CVE-2014-3667 [MEDIUM] Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code
Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code
Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
No detection rules found.
No public exploits indexed.
2014-10-16
Published