GitHub Advisoryadvisory · Maven

GHSA-8x8p-mfwv-9fjw Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

MEDIUM Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2014-3680
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-02-08

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.566, < 1.583 → fixed in 1.583 • Maven org.jenkins-ci.main:jenkins-core: < 1.565.3 → fixed in 1.565.3

Description

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.

Related

Alias · CVE (1)

  • CVE-2014-3680 Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References