PatchTheCVEjenkins-ci vulnerabilities
Recent CVEs affecting jenkins-ci products. 5 tracked.
jenkins-ci has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2014-10-16. Highest priority: CVE-2014-3679 (score 37/100).
- CVE-2014-3679 MEDIUM 5.0 UPGRADE The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by acc
- CVE-2014-3678 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote atta
- CVE-2013-6374 LOW 3.5 UPGRADE Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows
- CVE-2013-6373 MEDIUM 5.5 UPGRADE The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows r
- CVE-2013-6372 LOW 2.1 UPGRADE The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local use
FAQ
How do I fix jenkins-ci vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is jenkins-ci being exploited right now?
None of the tracked jenkins-ci CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which jenkins-ci CVE should I patch first?
CVE-2014-3679 currently ranks highest (37/100): The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by acc.