GitHub Advisoryadvisory · Maven

GHSA-5xm3-48v5-6h7v Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code

MEDIUM Published 2022-05-17 Modified 2025-03-13 Official page ↗
Aliases
CVE-2014-3667
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.566, < 1.583 → fixed in 1.583 • Maven org.jenkins-ci.main:jenkins-core: < 1.565.3 → fixed in 1.565.3

Description

Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.

Related

Alias · CVE (1)

  • CVE-2014-3667 Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References