CVE-2014-3681: XSS
Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Other sources
Jenkins Security Advisory SECURITY-143 notes:
"XSS vulnerability in the Jenkins core"
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3681?
CVE-2014-3681 has been classified as a medium severity vulnerability due to its potential to allow remote script injection.
How do I fix CVE-2014-3681?
To fix CVE-2014-3681, upgrade to Jenkins version 1.583 or later, or LTS version 1.565.3 or later.
What types of attacks are possible with CVE-2014-3681?
CVE-2014-3681 allows attackers to perform cross-site scripting (XSS) attacks, enabling them to inject arbitrary scripts into web pages viewed by users.
Which versions of Jenkins are affected by CVE-2014-3681?
Versions of Jenkins earlier than 1.583 and LTS versions before 1.565.3 are affected by CVE-2014-3681.
Are any other applications affected by CVE-2014-3681?
Yes, the vulnerability also affects Red Hat OpenShift enterprise versions up to and including 3.1.