GHSA-64MC-2M9P-23C8 Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs

🗓️ 17 May 2022 03:53:35Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Jenkins before 1.583 and LTS before 1.565.3 allow remote authenticated users with Job Configure permission to create or destroy jobs.

Reporter	Title	Published	Views	Family All 57
FreeBSD	jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS	1 Oct 201400:00	–	freebsd
ArchLinux	jenkins: multiple issues	2 Oct 201400:00	–	archlinux
CVE	CVE-2014-3663	16 Oct 201419:00	–	cve
Cvelist	CVE-2014-3663	16 Oct 201419:00	–	cvelist
EUVD	EUVD-2022-2711	3 Oct 202520:07	–	euvd
Tenable Nessus	FreeBSD : jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS (549a2771-49cc-11e4-ae2c-c80aa9043978)	2 Oct 201400:00	–	nessus
Tenable Nessus	Jenkins < 1.583 / 1.565.3 and Jenkins Enterprise 1.532.x / 1.554.x / 1.565.x < 1.532.10.1 / 1.554.10.1 / 1.565.3.1 Multiple Vulnerabilities	4 Nov 201400:00	–	nessus
Tenable Nessus	RHEL 7 : openshift (RHSA-2016:0070)	6 Dec 201800:00	–	nessus
Tenable Nessus	RHCOS 3 : Red Hat OpenShift Enterprise 3.1.1 update (Important) (RHSA-2016:0070)	4 May 202600:00	–	nessus
Github Security Blog	Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs	17 May 202203:53	–	github

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-3663
access	www.access.redhat.com/errata/RHBA-2014:1630
access	www.access.redhat.com/errata/RHSA-2016:0070
access	www.access.redhat.com/security/cve/CVE-2014-3663
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
wiki	www.wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01

04 Dec 2024 05:29Current

7.3High risk

Vulners AI Score7.3

CVSS 26

EPSS0.01384