CVE-2014-3663: Medium severity jenkins lts vulnerability
Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.
Other sources
Jenkins Security Advisory SECURITY-127 notes:
"User with a permission limited to configuring a job can effectively create a new job."
Jenkins Security Advisory SECURITY-128 notes:
"User with a permission limited to configuring a job can effectively destroy other jobs through renaming"
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3663?
CVE-2014-3663 is classified as a medium severity vulnerability due to its potential for unauthorized job manipulation by authenticated users.
How do I fix CVE-2014-3663?
To remediate CVE-2014-3663, upgrade Jenkins to version 1.583 or later and make sure Red Hat OpenShift is patched to the latest version.
What types of users are affected by CVE-2014-3663?
CVE-2014-3663 affects remote authenticated users who possess the Job/CONFIGURE permission in Jenkins.
What can attackers do in CVE-2014-3663?
Attackers exploiting CVE-2014-3663 can bypass restrictions to create or delete arbitrary jobs in Jenkins.
Which versions of Jenkins are vulnerable to CVE-2014-3663?
Jenkins versions before 1.583 and LTS versions before 1.565.3 are vulnerable to CVE-2014-3663.