Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Dec 10, 2025 | Oct 1, 2014 |
| Jenkins 2014 10 01 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 1.565.3Upgrade Jenkins to version 1.583 | Nov 13, 2017 | Oct 16, 2014 |
| Redhat Openshift | — | Upgrade openshift-ansibleUpgrade nodejs-repeat-elementUpgrade nodejs-glob-baseUpgrade nodejs-is-plain-objUpgrade nodejs-nodemonUpgrade nodejs-regex-cacheUpgrade nodejs-micromatchUpgrade nodejs-expand-bracketsUpgrade nodejs-timed-outUpgrade nodejs-create-error-classUpgrade nodejs-lodash.defaultsUpgrade nodejs-arrifyUpgrade nodejs-is-redirectUpgrade openshift-origin-cartridge-jenkinsUpgrade nodejs-parse-globUpgrade nodejs-fill-rangeUpgrade nodejs-lodash.baseassignUpgrade nodejs-configstoreUpgrade nodejs-filename-regexUpgrade origin-kibanaUpgrade nodejs-preserveUpgrade nodejs-osenvUpgrade nodejs-lodash.assignUpgrade nodejs-for-inUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-extglobUpgrade nodejs-undefsafeUpgrade nodejs-parse-jsonUpgrade nodejs-randomaticUpgrade nodejs-url-parse-laxUpgrade nodejs-semverUpgrade nodejs-object.omitUpgrade nodejs-extglobUpgrade nodejs-es6-promiseUpgrade nodejs-latest-versionUpgrade nodejs-lowercase-keysUpgrade nodejs-pinkieUpgrade nodejs-chokidarUpgrade nodejs-splitUpgrade nodejs-is-extendableUpgrade nodejs-fromUpgrade nodejs-mkdirpUpgrade nodejs-readdirpUpgrade openvswitchUpgrade jenkins-plugin-openshiftUpgrade nodejs-rcUpgrade atomic-openshiftUpgrade nodejs-package-jsonUpgrade nodejs-object-assignUpgrade jenkinsUpgrade nss_wrapperUpgrade nodejs-async-eachUpgrade nodejs-read-all-streamUpgrade nodejs-ansi-wrapUpgrade nodejs-strip-json-commentsUpgrade nodejs-kind-ofUpgrade nodejs-lodash.createassignerUpgrade nodejs-write-file-atomicUpgrade nodejs-pause-streamUpgrade nodejs-arr-diffUpgrade nodejs-success-symbolUpgrade nodejs-bracesUpgrade nodejs-anymatchUpgrade nodejs-stream-combinerUpgrade nodejs-prepend-httpUpgrade nodejs-node-status-codesUpgrade nodejs-binary-extensionsUpgrade nodejs-gotUpgrade nodejs-is-primitiveUpgrade nodejs-duplexerUpgrade nodejs-is-streamUpgrade nodejs-slideUpgrade nodejs-registry-urlUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-graceful-fsUpgrade nodejs-optimistUpgrade nodejs-lodash.basecopyUpgrade nodejs-uuidUpgrade nodejs-normalize-pathUpgrade nodejs-for-ownUpgrade nodejs-align-textUpgrade nodejs-glob-parentUpgrade nodejs-is-dotfileUpgrade nodejs-pinkie-promiseUpgrade nodejs-ps-treeUpgrade nodejs-os-homedirUpgrade nodejs-update-notifierUpgrade nodejs-expand-rangeUpgrade nodejs-event-streamUpgrade nodejs-os-tmpdirUpgrade nodejs-xdg-basedirUpgrade nodejs-lazy-cacheUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-lodash.isarrayUpgrade heapsterUpgrade nodejs-ansi-greenUpgrade nodejs-is-binary-pathUpgrade nodejs-deep-extendUpgrade nodejs-isobjectUpgrade nodejs-lodash.isargumentsUpgrade nodejs-arr-flattenUpgrade nodejs-lodash.restparamUpgrade nodejs-duplexifyUpgrade nodejs-string-lengthUpgrade nodejs-semver-diffUpgrade nodejs-touchUpgrade nodejs-error-exUpgrade nodejs-iniUpgrade nodejs-capture-stack-traceUpgrade nodejs-array-uniqueUpgrade nodejs-is-equal-shallowUpgrade nodejs-lodash.keysUpgrade nodejs-throughUpgrade nodejs-map-streamUpgrade nodejs-is-npmUpgrade nodejs-is-globUpgrade nodejs-is-numberUpgrade nodejs-unzip-responseUpgrade nodejs-end-of-stream | Jun 18, 2018 | Oct 2, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
