medium6.0
CVE-2014-3663
Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs
Impact
Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | >= 1.566, < 1.583 | 1.583 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Jenkins | through 1.565.2 through 1.582 |
| Redhat | Openshift | through 3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2016:0070
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
- https://github.com/advisories/GHSA-64mc-2m9p-23c8
- https://nvd.nist.gov/vuln/detail/CVE-2014-3663
- https://access.redhat.com/errata/RHBA-2014:1630
- https://access.redhat.com/security/cve/CVE-2014-3663
- https://bugzilla.redhat.com/show_bug.cgi?id=1147764