CVE-2014-3667

2014-10-1619:55:08

CWE-200

redhat

web.nvd.nist.gov

jenkins

cve

2014

3667

information disclosure

plugin

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

46.3%

JSON

Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.

Affected configurations

Nvd

Node

redhatopenshiftRange≤3.1enterprise

Node

jenkinsjenkinsRange≤1.582

Node

jenkinsjenkinsRange≤1.565.2lts

VendorProductVersionCPE
redhatopenshift*cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
redhat	openshift	*	cpe:2.3:a:redhat:openshift:::::enterprise:::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins::::::::
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::lts:::*