The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS
    before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive
    information via vectors related to heapDump. (CVE-2014-2068)

The remote web server hosts a version of Jenkins or Jenkins Enterprise that is affected by multiple vulnerabilities :

  - A flaw in the default markup formatter allows cross-site     scripting via the Description field in the user     configuration. (CVE-2013-5573)

  - A security bypass vulnerability allows remote     authenticated attackers to change configurations and     execute arbitrary jobs. (CVE-2013-7285, CVE-2013-7330,     CVE-2014-2058)

  - An unspecified flaw in the Winstone servlet allows     remote attackers to hijack sessions. (CVE-2014-2060)

  - An input control flaw in 'PasswordParameterDefinition'     allows remote attackers to disclose sensitive     information including passwords. (CVE-2014-2061)

  - A security bypass vulnerability due to API tokens not     being invalidated when a user is deleted.
    (CVE-2014-2062)

  - An unspecified flaw allows remote attackers to conduct     clickjacking attacks. (CVE-2014-2063)

  - An information disclosure vulnerability in the     'loadUserByUsername' function allows remote attackers     to determine whether a user exists via vectors related     to failed login attempts. (CVE-2014-2064)

  - A cross-site scripting vulnerability due to improper     input validation to the 'iconSize' cookie.
    (CVE-2014-2065)

  - A session fixation vulnerability allows remote attackers     to hijack web sessions. (CVE-2014-2066)

  - An information disclosure vulnerability in the 'doIndex'     function in 'hudson/util/RemotingDiagnostics.java'     allows remote authenticated users with the     'ADMINISTRATOR' permission to obtain sensitive     information via heapDump. (CVE-2014-2068)

ID	Name	Product	Family	Severity
432996	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-pv88-j6rg-r56p)	Tenable Cloud Security	SCA Checks	low
432996	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-pv88-j6rg-r56p)	Tenable Self-Hosted Container Security	SCA Checks	low
72685	Jenkins < 1.551 / 1.532.2 and Jenkins Enterprise 1.509.x / 1.532.x < 1.509.5.1 / 1.532.2.2 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2014-2068

low

Tenable Plugins

low

low

high