CVE-2014-2064: Infoleak

Q: What is the severity of CVE-2014-2064?

CVE-2014-2064 has a medium severity level due to its ability to allow remote attackers to determine user existence.

Q: How do I fix CVE-2014-2064?

To fix CVE-2014-2064, you should upgrade Jenkins to version 1.551 or later, or 1.532.2 if using LTS.

Q: Who is affected by CVE-2014-2064?

CVE-2014-2064 affects Jenkins versions prior to 1.551 and LTS versions before 1.532.2.

Q: What type of vulnerability is CVE-2014-2064?

CVE-2014-2064 is a vulnerability that allows an attacker to enumerate users through failed login attempts.

Q: Can CVE-2014-2064 lead to further attacks?

Yes, by confirming user existence, CVE-2014-2064 can potentially facilitate further attacks such as credential stuffing.

Published Oct 17, 2014

Updated

The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

Affected Software

4 affected componentsFixes available

maven/org.jenkins-ci.main:jenkins-core<1.532.2

1.532.2

maven/org.jenkins-ci.main:jenkins-core>=1.533<1.551

1.551

Jenkins Jenkins<=1.532.1

Jenkins Jenkins<=1.550

Remediation

Patch Available

https://github.com/jenkinsci/jenkins/commit/fbf96734470caba9364f04e0b77b0bae7293a1ec

Event History

Oct 17, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

May 17, 2022

Advisory Published

via GitHub·03:53 AM

Frequently Asked Questions

What is the severity of CVE-2014-2064?

CVE-2014-2064 has a medium severity level due to its ability to allow remote attackers to determine user existence.

How do I fix CVE-2014-2064?