CVE-2014-3665

Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
jenkinsjenkins
𝑥
≤ 1.586
jenkinsjenkins
𝑥
≤ 1.565.3
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jenkins
zesty
dne
yakkety
dne
xenial
dne
wily
dne
vivid
dne
utopic
dne
trusty
dne
precise
ignored
lucid
dne
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1147767
https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30
https://www.cloudbees.com/jenkins-security-advisory-2014-10-30
https://bugzilla.redhat.com/show_bug.cgi?id=1147767
https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30
https://www.cloudbees.com/jenkins-security-advisory-2014-10-30