CVE-2014-2067: XSS
Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 1.532.2 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 1.551
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2067?
CVE-2014-2067 has a medium severity rating due to its ability to allow remote authenticated users to execute arbitrary scripts.
How do I fix CVE-2014-2067?
To fix CVE-2014-2067, upgrade Jenkins to version 1.551 or later, or 1.532.2 for LTS versions.
What versions of Jenkins are affected by CVE-2014-2067?
CVE-2014-2067 affects Jenkins versions before 1.551 and Jenkins LTS versions before 1.532.2.
Can CVE-2014-2067 be exploited without authentication?
No, CVE-2014-2067 requires remote authenticated users to exploit the vulnerability.
What type of vulnerability is CVE-2014-2067?
CVE-2014-2067 is a cross-site scripting (XSS) vulnerability.