VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 1, 2014· Updated Apr 29, 2026

CVE-2014-2059

CVE-2014-2059

Description

Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.main:jenkins-coreMaven
>= 1.533, < 1.5511.551
org.jenkins-ci.main:jenkins-coreMaven
< 1.532.21.532.2

Affected products

2
  • Jenkins/Jenkins2 versions
    cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*range: <=1.550
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <=1.532.1

Patches

1
ad38d8480f20

[FIXED SECURITY-108] Check job name created via CLI

https://github.com/jenkinsci/jenkinsVojtech JuranekFeb 6, 2014via ghsa
commit
1 file changed · +1 −0
  • core/src/main/java/hudson/cli/CreateJobCommand.java+1 −0 modified
    @@ -72,6 +72,7 @@ protected int run() throws Exception {
             name = name.substring(i + 1);
         }
 
+        Jenkins.checkGoodName(name);
         ig.createProjectFromXML(name, stdin);
         return 0;
     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.