Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.0

Jenkins: Authenticated Users Can Read Sensitive Files

CVE-2014-3664 · published 12 years ago
Summary

Jenkins versions before 1.583 and LTS before 1.565.3 have a security issue that allows users with certain permissions to access files they shouldn't be able to read. This could potentially expose sensitive information to unauthorized users. Update to a patched version of Jenkins to fix this issue.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.583.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.565.3.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core >= 1.566, < 1.583
< 1.565.3
Fix: upgrade to 1.583
– jenkins jenkins <= 1.565.2
<= 1.582
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
– redhat openshift <= 3.1
cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
Original advisory text
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
References
Severity
4.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published15 Oct 2014
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-3gp5-92h5-h855 · GHSA
CVE-2014-3664 · NVD
Track software like this
Free during beta