Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Oct 1, 2014 |
| Jenkins 2014 10 01 | — | Upgrade Jenkins to version 1.583Upgrade Jenkins LTS to version 1.565.3Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest version | Nov 13, 2017 | Oct 16, 2014 |
| Redhat Openshift | — | Upgrade jenkinsUpgrade nodejs-prepend-httpUpgrade heapsterUpgrade nodejs-randomaticUpgrade nodejs-semver-diffUpgrade nodejs-arrifyUpgrade nodejs-os-tmpdirUpgrade nodejs-ansi-wrapUpgrade nss_wrapperUpgrade nodejs-filename-regexUpgrade nodejs-array-uniqueUpgrade nodejs-pinkie-promiseUpgrade nodejs-iniUpgrade nodejs-xdg-basedirUpgrade openshift-ansibleUpgrade nodejs-for-ownUpgrade nodejs-nodemonUpgrade nodejs-is-binary-pathUpgrade nodejs-fromUpgrade nodejs-is-extglobUpgrade nodejs-splitUpgrade nodejs-pinkieUpgrade nodejs-timed-outUpgrade nodejs-fill-rangeUpgrade nodejs-micromatchUpgrade nodejs-for-inUpgrade nodejs-is-dotfileUpgrade nodejs-end-of-streamUpgrade nodejs-object-assignUpgrade nodejs-readdirpUpgrade nodejs-ps-treeUpgrade nodejs-lodash.baseassignUpgrade nodejs-is-extendableUpgrade nodejs-lodash.basecopyUpgrade nodejs-is-npmUpgrade nodejs-lodash.isarrayUpgrade nodejs-lodash.keysUpgrade nodejs-parse-globUpgrade nodejs-slideUpgrade nodejs-preserveUpgrade nodejs-glob-baseUpgrade openshift-origin-cartridge-jenkinsUpgrade nodejs-error-exUpgrade nodejs-touchUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-string-lengthUpgrade nodejs-semverUpgrade nodejs-package-jsonUpgrade nodejs-lodash.createassignerUpgrade nodejs-deep-extendUpgrade nodejs-parse-jsonUpgrade nodejs-lodash.defaultsUpgrade nodejs-is-plain-objUpgrade nodejs-capture-stack-traceUpgrade nodejs-normalize-pathUpgrade nodejs-align-textUpgrade nodejs-read-all-streamUpgrade nodejs-uuidUpgrade nodejs-success-symbolUpgrade nodejs-bracesUpgrade nodejs-chokidarUpgrade nodejs-lodash.restparamUpgrade nodejs-duplexifyUpgrade nodejs-configstoreUpgrade nodejs-async-eachUpgrade jenkins-plugin-openshiftUpgrade nodejs-binary-extensionsUpgrade nodejs-optimistUpgrade nodejs-is-globUpgrade nodejs-throughUpgrade nodejs-stream-combinerUpgrade nodejs-lodash.assignUpgrade nodejs-undefsafeUpgrade nodejs-anymatchUpgrade nodejs-is-streamUpgrade nodejs-is-equal-shallowUpgrade nodejs-lazy-cacheUpgrade nodejs-glob-parentUpgrade nodejs-map-streamUpgrade nodejs-strip-json-commentsUpgrade nodejs-create-error-classUpgrade nodejs-duplexerUpgrade nodejs-is-numberUpgrade nodejs-node-status-codesUpgrade nodejs-lowercase-keysUpgrade nodejs-es6-promiseUpgrade nodejs-os-homedirUpgrade nodejs-extglobUpgrade nodejs-gotUpgrade nodejs-expand-rangeUpgrade nodejs-rcUpgrade nodejs-arr-flattenUpgrade nodejs-pause-streamUpgrade nodejs-event-streamUpgrade nodejs-ansi-greenUpgrade nodejs-latest-versionUpgrade nodejs-regex-cacheUpgrade nodejs-osenvUpgrade nodejs-write-file-atomicUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-redirectUpgrade nodejs-unzip-responseUpgrade origin-kibanaUpgrade openvswitchUpgrade nodejs-graceful-fsUpgrade nodejs-expand-bracketsUpgrade nodejs-url-parse-laxUpgrade nodejs-repeat-elementUpgrade nodejs-is-primitiveUpgrade nodejs-isobjectUpgrade nodejs-kind-ofUpgrade nodejs-update-notifierUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-lodash.isargumentsUpgrade nodejs-registry-urlUpgrade nodejs-arr-diffUpgrade nodejs-mkdirpUpgrade nodejs-object.omitUpgrade atomic-openshift | Jun 18, 2018 | Oct 2, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub