PT-2015-3731 · Cloudbees+1 · Jenkins

Kohsuke + 1 · Published 2015-11-25 · Updated 2023-02-13 · CVE-2014-3665

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.587 Jenkins LTS versions prior to 1.580.1

Description The issue is related to improper trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.

Recommendations For Jenkins versions prior to 1.587, update to version 1.587 or later. For Jenkins LTS versions prior to 1.580.1, update to version 1.580.1 or later.

Fix

RCE

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3665

GHSA-66CR-6WHX-732P

Affected Products

Jenkins

References · 9

• https://cloudbees.com/jenkins-security-advisory-2014-10-30 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66cr-6whx-732p · Vendor Advisory
• https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control · Vendor Advisory
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3665 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3665 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1147767 · Note
• https://access.redhat.com/security/cve/CVE-2014-3665 · Note
• https://access.redhat.com/errata/RHBA-2014:1630 · Note