Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Oct 1, 2014 |
| Jenkins 2014 10 01 | — | Upgrade Jenkins LTS to version 1.565.3Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.583 | Nov 13, 2017 | Oct 15, 2014 |
| Redhat Openshift | — | Upgrade nodejs-preserveUpgrade nodejs-parse-globUpgrade nodejs-is-npmUpgrade nodejs-mkdirpUpgrade nodejs-is-redirectUpgrade nodejs-arr-diffUpgrade nodejs-splitUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-extglobUpgrade nodejs-lodash.keysUpgrade nodejs-write-file-atomicUpgrade nodejs-filename-regexUpgrade nss_wrapperUpgrade nodejs-extglobUpgrade nodejs-ansi-wrapUpgrade nodejs-async-eachUpgrade nodejs-is-extendableUpgrade atomic-openshiftUpgrade nodejs-glob-baseUpgrade nodejs-timed-outUpgrade nodejs-configstoreUpgrade nodejs-latest-versionUpgrade nodejs-lodash.baseassignUpgrade nodejs-read-all-streamUpgrade openvswitchUpgrade nodejs-lodash.createassignerUpgrade nodejs-lodash.isarrayUpgrade nodejs-undefsafeUpgrade nodejs-fromUpgrade origin-kibanaUpgrade nodejs-micromatchUpgrade nodejs-fill-rangeUpgrade nodejs-arrifyUpgrade nodejs-es6-promiseUpgrade nodejs-pinkieUpgrade nodejs-chokidarUpgrade jenkinsUpgrade nodejs-lodash.restparamUpgrade nodejs-package-jsonUpgrade nodejs-randomaticUpgrade nodejs-success-symbolUpgrade nodejs-object-assignUpgrade nodejs-pause-streamUpgrade nodejs-lodash.defaultsUpgrade nodejs-strip-json-commentsUpgrade nodejs-uuidUpgrade nodejs-for-inUpgrade nodejs-semverUpgrade nodejs-string-lengthUpgrade nodejs-is-equal-shallowUpgrade openshift-ansibleUpgrade nodejs-regex-cacheUpgrade nodejs-parse-jsonUpgrade nodejs-is-plain-objUpgrade nodejs-repeat-elementUpgrade nodejs-touchUpgrade nodejs-readdirpUpgrade nodejs-url-parse-laxUpgrade nodejs-lodash.basecopyUpgrade nodejs-nodemonUpgrade nodejs-osenvUpgrade openshift-origin-cartridge-jenkinsUpgrade nodejs-pinkie-promiseUpgrade nodejs-ansi-greenUpgrade nodejs-bracesUpgrade nodejs-event-streamUpgrade nodejs-is-primitiveUpgrade nodejs-os-tmpdirUpgrade nodejs-anymatchUpgrade nodejs-binary-extensionsUpgrade nodejs-unzip-responseUpgrade nodejs-duplexifyUpgrade nodejs-end-of-streamUpgrade nodejs-capture-stack-traceUpgrade nodejs-gotUpgrade nodejs-glob-parentUpgrade nodejs-throughUpgrade nodejs-slideUpgrade heapsterUpgrade nodejs-xdg-basedirUpgrade nodejs-is-numberUpgrade nodejs-create-error-classUpgrade nodejs-normalize-pathUpgrade jenkins-plugin-openshiftUpgrade nodejs-rcUpgrade nodejs-iniUpgrade nodejs-lazy-cacheUpgrade nodejs-duplexerUpgrade nodejs-graceful-fsUpgrade nodejs-is-dotfileUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-object.omitUpgrade nodejs-deep-extendUpgrade nodejs-stream-combinerUpgrade nodejs-semver-diffUpgrade nodejs-expand-bracketsUpgrade nodejs-error-exUpgrade nodejs-update-notifierUpgrade nodejs-optimistUpgrade nodejs-isobjectUpgrade nodejs-lodash.isargumentsUpgrade nodejs-for-ownUpgrade nodejs-array-uniqueUpgrade nodejs-expand-rangeUpgrade nodejs-os-homedirUpgrade nodejs-lodash.assignUpgrade nodejs-align-textUpgrade nodejs-registry-urlUpgrade nodejs-arr-flattenUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-is-streamUpgrade nodejs-node-status-codesUpgrade nodejs-lowercase-keysUpgrade nodejs-map-streamUpgrade nodejs-kind-ofUpgrade nodejs-is-globUpgrade nodejs-prepend-httpUpgrade nodejs-is-binary-pathUpgrade nodejs-ps-tree | Jun 18, 2018 | Oct 2, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub