Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Oct 1, 2014 |
| Jenkins 2014 10 01 | — | Upgrade Jenkins LTS to version 1.565.3Upgrade Jenkins to version 1.583Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest version | Nov 13, 2017 | Oct 16, 2014 |
| Redhat Openshift | — | Upgrade nodejs-array-uniqueUpgrade nodejs-object.omitUpgrade nodejs-package-jsonUpgrade nodejs-unzip-responseUpgrade nodejs-parse-globUpgrade nodejs-object-assignUpgrade nodejs-anymatchUpgrade openshift-ansibleUpgrade nodejs-ansi-greenUpgrade origin-kibanaUpgrade nodejs-slideUpgrade nodejs-duplexerUpgrade nodejs-micromatchUpgrade nodejs-for-ownUpgrade nodejs-is-numberUpgrade nodejs-semver-diffUpgrade nodejs-lodash.defaultsUpgrade nodejs-strip-json-commentsUpgrade nodejs-map-streamUpgrade nodejs-isobjectUpgrade nodejs-capture-stack-traceUpgrade nodejs-preserveUpgrade nodejs-ps-treeUpgrade nodejs-repeat-elementUpgrade nodejs-undefsafeUpgrade nodejs-regex-cacheUpgrade nodejs-fill-rangeUpgrade nodejs-es6-promiseUpgrade nodejs-pinkieUpgrade nodejs-is-extglobUpgrade nodejs-uuidUpgrade jenkins-plugin-openshiftUpgrade nodejs-timed-outUpgrade nodejs-binary-extensionsUpgrade nodejs-ansi-wrapUpgrade nodejs-graceful-fsUpgrade nodejs-rcUpgrade nodejs-lodash.basecopyUpgrade nodejs-pinkie-promiseUpgrade nodejs-os-homedirUpgrade nodejs-is-extendableUpgrade atomic-openshiftUpgrade nodejs-randomaticUpgrade nodejs-stream-combinerUpgrade nodejs-expand-rangeUpgrade nodejs-arrifyUpgrade nodejs-deep-extendUpgrade nodejs-string-lengthUpgrade nodejs-align-textUpgrade nodejs-fromUpgrade nodejs-async-eachUpgrade jenkinsUpgrade nodejs-lowercase-keysUpgrade nodejs-registry-urlUpgrade nodejs-is-streamUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-write-file-atomicUpgrade nodejs-throughUpgrade nodejs-is-globUpgrade nss_wrapperUpgrade nodejs-pause-streamUpgrade nodejs-arr-flattenUpgrade nodejs-osenvUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-equal-shallowUpgrade nodejs-os-tmpdirUpgrade nodejs-bracesUpgrade nodejs-success-symbolUpgrade nodejs-lodash.createassignerUpgrade nodejs-error-exUpgrade nodejs-glob-baseUpgrade nodejs-xdg-basedirUpgrade openvswitchUpgrade nodejs-configstoreUpgrade openshift-origin-cartridge-jenkinsUpgrade nodejs-event-streamUpgrade nodejs-mkdirpUpgrade nodejs-end-of-streamUpgrade heapsterUpgrade nodejs-nodemonUpgrade nodejs-lodash.keysUpgrade nodejs-url-parse-laxUpgrade nodejs-read-all-streamUpgrade nodejs-is-binary-pathUpgrade nodejs-lodash.assignUpgrade nodejs-arr-diffUpgrade nodejs-node-status-codesUpgrade nodejs-lodash.restparamUpgrade nodejs-lazy-cacheUpgrade nodejs-glob-parentUpgrade nodejs-is-npmUpgrade nodejs-is-dotfileUpgrade nodejs-gotUpgrade nodejs-expand-bracketsUpgrade nodejs-is-primitiveUpgrade nodejs-is-redirectUpgrade nodejs-update-notifierUpgrade nodejs-optimistUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-normalize-pathUpgrade nodejs-chokidarUpgrade nodejs-lodash.baseassignUpgrade nodejs-create-error-classUpgrade nodejs-splitUpgrade nodejs-extglobUpgrade nodejs-prepend-httpUpgrade nodejs-for-inUpgrade nodejs-is-plain-objUpgrade nodejs-latest-versionUpgrade nodejs-duplexifyUpgrade nodejs-semverUpgrade nodejs-readdirpUpgrade nodejs-touchUpgrade nodejs-parse-jsonUpgrade nodejs-lodash.isarrayUpgrade nodejs-lodash.isargumentsUpgrade nodejs-iniUpgrade nodejs-kind-ofUpgrade nodejs-filename-regex | Jun 18, 2018 | Oct 2, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub