CVE-2014-3667: Infoleak
Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
Other sources
Jenkins Security Advisory SECURITY-155 notes:
"Plugin binaries used by Jenkins can be downloaded by users who shouldn't have that access."
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3667?
CVE-2014-3667 is classified as a medium severity vulnerability that can lead to sensitive information disclosure.
How do I fix CVE-2014-3667?
To mitigate CVE-2014-3667, update Jenkins to version 1.583 or later, or version 1.565.3 for LTS.
Who is affected by CVE-2014-3667?
CVE-2014-3667 affects Jenkins versions prior to 1.583 and LTS versions prior to 1.565.3, as well as certain versions of Red Hat OpenShift.
What type of vulnerability is CVE-2014-3667?
CVE-2014-3667 is a vulnerability that allows remote authenticated users to access sensitive information by exploiting inadequate restrictions on plugin downloads.
Is there a workaround for CVE-2014-3667?
There are no known workarounds for CVE-2014-3667; the recommended action is to upgrade to the fixed versions.