CVE-2014-3665

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1147767
https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+ControlVendor Advisory
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30Vendor Advisory
https://www.cloudbees.com/jenkins-security-advisory-2014-10-30Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1147767
https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+ControlVendor Advisory
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30Vendor Advisory
https://www.cloudbees.com/jenkins-security-advisory-2014-10-30Vendor Advisory

Timeline

Published: Nov 25, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-36667.5Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.CVE-2014-36674.0Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with t CVE-2014-36685.0Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before CVE-2014-36697.5Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x befor CVE-2014-36706.8The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates CVE-2014-36726.5The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by CVE-2014-36737.5The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malform CVE-2014-36747.5Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network reso CVE-2014-36755.0Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.CVE-2014-36767.5Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHC CVE-2014-36777.5Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.CVE-2014-36784.3Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web