The remote web server hosts a version of Jenkins (open source) or CloudBees Jenkins Enterprise that is affected by multiple vulnerabilities :

  - An error exists related to file upload processing that     allows a remote attacker to overwrite arbitrary files.
    (CVE-2013-2186)

  - An input validation error exists related to the included     'ZeroClipboard' component that allows cross-site     scripting attacks. (CVE-2014-1869)

  - An error exists related to 'CLI handshake' handling that     allows denial of service attacks. (CVE-2014-3661)

  - An error exists related to handling login attempts using     non-existent or incorrect account names that allows a     remote attacker to enumerate application user names.
    (CVE-2014-3662)

  - An error exists related to handling users having     'Job/CONFIGURE' permissions that allows such users to     perform actions meant only for 'Job/CREATE' permissions.
    (CVE-2014-3663)

  - An error exists related to handling users having     'Overall/READ' permissions that allows directory     traversal attacks. (CVE-2014-3664)

  - An error exists related to the 'CLI channel' that allows     arbitrary code execution by a remote attacker on the     Jenkins master. (CVE-2014-3666)

  - An error exists related to handling users having     'Overall/READ' permissions that allows plugin source     code to be disclosed. (CVE-2014-3667)

  - An input validation error exists related to the     'Monitoring' plugin that allows cross-site scripting     attacks. (CVE-2014-3678)

  - An error exists related to the 'Monitoring' plugin that     allows unauthorized access to sensitive information.
    (CVE-2014-3679)

  - An error exists related to handling users having     'Job/READ' permissions that allows such users to     obtain default passwords belonging to parameterized     jobs. (CVE-2014-3680)

  - An unspecified input validation error allows cross-site     scripting attacks. (CVE-2014-3681)

Detections

Analytics

Jenkins < 1.583 / 1.565.3 and Jenkins Enterprise 1.532.x / 1.554.x / 1.565.x < 1.532.10.1 / 1.554.10.1 / 1.565.3.1 Multiple Vulnerabilities

critical Nessus Plugin ID 78859

Version 1.9