CVE-2014-2058: Medium severity jenkins lts vulnerability

Q: What is the severity of CVE-2014-2058?

CVE-2014-2058 has a medium severity rating allowing remote authenticated users to execute arbitrary jobs.

Q: How do I fix CVE-2014-2058?

To fix CVE-2014-2058, upgrade to Jenkins version 1.532.2 or 1.551 or later.

Q: What can happen if I don't patch CVE-2014-2058?

If CVE-2014-2058 is not patched, authenticated users can bypass access restrictions and trigger unauthorized jobs.

Q: Which versions of Jenkins are affected by CVE-2014-2058?

Jenkins versions before 1.551 and LTS versions before 1.532.2 are affected by CVE-2014-2058.

Q: Is there a workaround for CVE-2014-2058?

There is no official workaround for CVE-2014-2058; the recommended action is to update to a patched version.

Published Oct 17, 2014

Updated

BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.

Affected Software

4 affected componentsFixes available

maven/org.jenkins-ci.main:jenkins-core<1.532.2

1.532.2

maven/org.jenkins-ci.main:jenkins-core>=1.533<1.551

1.551

Jenkins Jenkins<=1.532.1

Jenkins Jenkins<=1.550

Remediation

Patch Available

https://github.com/jenkinsci/jenkins/commit/b6b2a367a7976be80a799c6a49fa6c58d778b50e

Event History

Oct 17, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

May 17, 2022

Advisory Published

via GitHub·03:53 AM

Frequently Asked Questions

What is the severity of CVE-2014-2058?

CVE-2014-2058 has a medium severity rating allowing remote authenticated users to execute arbitrary jobs.

How do I fix CVE-2014-2058?