CVE-2014-3664: Path Traversal
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
Other sources
Jenkins Security Advisory SECURITY-131 notes:
"Anonymous users gain access to arbitrary files that the Jenkins process can see"
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3664?
CVE-2014-3664 is classified as a medium severity vulnerability.
How do I fix CVE-2014-3664?
To fix CVE-2014-3664, upgrade Jenkins to version 1.583 or later, or LTS version 1.565.3 or later.
Who is affected by CVE-2014-3664?
CVE-2014-3664 affects Jenkins versions prior to 1.583 and LTS versions before 1.565.3, as well as Red Hat OpenShift version up to 3.1.
What impacts can CVE-2014-3664 have on my system?
CVE-2014-3664 allows remote authenticated users to read arbitrary files, potentially exposing sensitive information.
Is there a workaround for CVE-2014-3664?
There is no specific workaround for CVE-2014-3664; the recommended action is to upgrade to a patched version.