CVE-2014-2068: Low severity jenkins lts vulnerability
Published Oct 17, 2014
·Updated
The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
Affected Software
4 affected componentsFixes available
maven/org.jenkins-ci.main:jenkins-core<1.532.2
1.532.2
maven/org.jenkins-ci.main:jenkins-core>=1.533<1.551
1.551
Jenkins Jenkins<=1.550
Jenkins Jenkins<=1.532.1
Remediation
Event History
Oct 17, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·03:53 AM
Frequently Asked Questions
1
What is the severity of CVE-2014-2068?
CVE-2014-2068 has a medium severity rating due to the potential exposure of sensitive information.
2
How do I fix CVE-2014-2068?
To mitigate CVE-2014-2068, upgrade Jenkins to version 1.551 or later, or LTS 1.532.2 or later.
3
Who is affected by CVE-2014-2068?
CVE-2014-2068 affects remote authenticated users with the ADMINISTER permission in vulnerable versions of Jenkins.
4
What information can be obtained through CVE-2014-2068?
CVE-2014-2068 allows attackers to obtain sensitive information related to heap dumps.
5
When was CVE-2014-2068 discovered?
CVE-2014-2068 was publicly disclosed on February 14, 2014.