PT-2014-4459 · Cloudbees+1 · Jenkins

Published 2014-02-28 · Updated 2022-05-17 · CVE-2014-2059

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.551 Jenkins LTS versions prior to 1.532.2

Description A directory traversal issue exists in the CLI job creation, allowing remote authenticated users to overwrite arbitrary files via the job name. This is due to a vulnerability in the hudson/cli/CreateJobCommand.java component.

Recommendations For versions prior to 1.551, update to version 1.551 or later to resolve the issue. For LTS versions prior to 1.532.2, update to version 1.532.2 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-2059

GHSA-V759-3FH9-84MX

Affected Products

Jenkins

References · 7

• https://github.com/jenkinsci/jenkins/commit/ad38d8480f20ce3cbf8fec3e2003bc83efda4f7d · Patch
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2059 · Security Note
• https://osv.dev/vulnerability/GHSA-v759-3fh9-84mx · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• http://seclists.org/oss-sec/2014/q1/421 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91346 · Note