CVE-2014-3681
published 2014-10-15CVE-2014-3681: Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.13%
80.1th percentile
Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | certain_pages_in_monitoring_plugin | — | — |
| jenkins | jenkins | < 1.565.3 | 1.565.3 |
| jenkins | jenkins | < 1.583 | 1.583 |
| jenkins | jenkins_core | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | user_of_monitoring_plugin | — | — |
| redhat | openshift | <= 3.1 | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins: cross-site scripting flaw in Jenkins core (SECURITY-143)
vendor_redhat·2014-10-02·CVSS 4.3
CVE-2014-3681 [MEDIUM] CWE-79 jenkins: cross-site scripting flaw in Jenkins core (SECURITY-143)
jenkins: cross-site scripting flaw in Jenkins core (SECURITY-143)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Package: jenkins (OpenShift Enterprise 1) - Will not fix
Jenkins
Jenkins Security Advisory 2014-10-01
vendor_jenkins·2014-10-01·CVSS 5.0
CVE-2013-2186 [MEDIUM] Jenkins Security Advisory 2014-10-01
Title: Jenkins Security Advisory 2014-10-01
Jenkins Security Advisory 2014-10-01
This advisory announces:
multiple security vulnerabilities that were found in Jenkins core.
two security vulnerabilities found in the monitoring plugin
Description
SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)
This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.
SECURITY-110/CVE-2014-3662 (User name discovery)
Anonymous users can test if the user of a specific name exists or not through login attempts.
SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)
An user with a permission limited to Job/CONF
OSV
Jenkins Cross-site Scripting vulnerability
osv·2022-05-14
CVE-2014-3681 [MEDIUM] Jenkins Cross-site Scripting vulnerability
Jenkins Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA
Jenkins Cross-site Scripting vulnerability
ghsa·2022-05-14
CVE-2014-3681 [MEDIUM] CWE-79 Jenkins Cross-site Scripting vulnerability
Jenkins Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2016:0070https://bugzilla.redhat.com/show_bug.cgi?id=1147766https://exchange.xforce.ibmcloud.com/vulnerabilities/96975https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01https://access.redhat.com/errata/RHSA-2016:0070https://bugzilla.redhat.com/show_bug.cgi?id=1147766https://exchange.xforce.ibmcloud.com/vulnerabilities/96975https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
2014-10-15
Published