Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins to version 1.638Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 1.625.2Upgrade Jenkins LTS to the latest version | Jul 23, 2026 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade openshift-origin-cartridge-phpUpgrade nodejs-array-uniqueUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-configstoreUpgrade nodejs-async-eachUpgrade nodejs-string-lengthUpgrade openshift-ansibleUpgrade nodejs-write-file-atomicUpgrade atomic-openshiftUpgrade nodejs-pause-streamUpgrade nodejs-align-textUpgrade nodejs-parse-globUpgrade nodejs-undefsafeUpgrade origin-kibanaUpgrade openvswitchUpgrade nodejs-lodash.defaultsUpgrade nodejs-extglobUpgrade nodejs-repeat-elementUpgrade nodejs-arr-diffUpgrade nodejs-strip-json-commentsUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-preserveUpgrade nodejs-is-plain-objUpgrade nodejs-is-redirectUpgrade nodejs-package-jsonUpgrade nodejs-lodash.basecopyUpgrade nodejs-glob-baseUpgrade nodejs-readdirpUpgrade nodejs-rcUpgrade nodejs-semverUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-read-all-streamUpgrade nodejs-success-symbolUpgrade nodejs-object-assignUpgrade nodejs-ansi-wrapUpgrade nodejs-timed-outUpgrade nodejs-lodash.restparamUpgrade nodejs-es6-promiseUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-mkdirpUpgrade nodejs-capture-stack-traceUpgrade nodejs-xdg-basedirUpgrade nodejs-regex-cacheUpgrade nodejs-chokidarUpgrade nodejs-splitUpgrade nodejs-lodash.keysUpgrade nodejs-is-extendableUpgrade nodejs-lodash.createassignerUpgrade nodejs-parse-jsonUpgrade nodejs-for-inUpgrade nodejs-fill-rangeUpgrade nodejs-is-equal-shallowUpgrade openshift-origin-cartridge-cronUpgrade nodejs-touchUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-nodemonUpgrade nodejs-error-exUpgrade nodejs-is-extglobUpgrade activemqUpgrade nodejs-micromatchUpgrade rhcUpgrade nodejs-latest-versionUpgrade nodejs-event-streamUpgrade nodejs-osenvUpgrade nodejs-os-tmpdirUpgrade nodejs-randomaticUpgrade nodejs-filename-regexUpgrade nodejs-arrifyUpgrade nss_wrapperUpgrade nodejs-duplexerUpgrade nodejs-lodash.baseassignUpgrade nodejs-ps-treeUpgrade nodejs-url-parse-laxUpgrade nodejs-optimistUpgrade nodejs-is-numberUpgrade nodejs-map-streamUpgrade nodejs-is-globUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-slideUpgrade nodejs-kind-ofUpgrade nodejs-fromUpgrade nodejs-object.omitUpgrade openshift-origin-broker-utilUpgrade nodejs-arr-flattenUpgrade nodejs-binary-extensionsUpgrade nodejs-node-status-codesUpgrade openshift-origin-node-utilUpgrade openshift-enterprise-upgradeUpgrade nodejs-gotUpgrade nodejs-for-ownUpgrade nodejs-end-of-streamUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-is-dotfileUpgrade nodejs-lodash.getnativeUpgrade phpUpgrade jenkinsUpgrade nodejs-stream-combinerUpgrade nodejs-duplexifyUpgrade nodejs-lodash.assignUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-lodash.isargumentsUpgrade nodejs-create-error-classUpgrade nodejs-expand-rangeUpgrade nodejs-semver-diffUpgrade nodejs-lazy-cacheUpgrade nodejs-lowercase-keysUpgrade nodejs-pinkieUpgrade nodejs-bracesUpgrade nodejs-deep-extendUpgrade nodejs-glob-parentUpgrade nodejs-anymatchUpgrade nodejs-update-notifierUpgrade nodejs-is-binary-pathUpgrade nodejs-os-homedirUpgrade nodejs-registry-urlUpgrade nodejs-uuidUpgrade nodejs-ansi-greenUpgrade nodejs-lodash.isarrayUpgrade nodejs-unzip-responseUpgrade nodejs-graceful-fsUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-iniUpgrade nodejs-isobjectUpgrade openshift-origin-node-proxyUpgrade heapsterUpgrade nodejs-prepend-httpUpgrade nodejs-expand-bracketsUpgrade nodejs-throughUpgrade nodejs-is-primitiveUpgrade nodejs-normalize-pathUpgrade nodejs-is-npmUpgrade nodejs-pinkie-promiseUpgrade nodejs-is-streamUpgrade rubygem-openshift-origin-common | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub