Moderate severityNVD Advisory· Published Oct 15, 2014· Updated May 6, 2026

CVE-2014-3664

Description

Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-coreMaven	>= 1.566, < 1.583	1.583
org.jenkins-ci.main:jenkins-coreMaven	< 1.565.3	1.565.3

Affected products

Jenkins/Jenkins2 versions
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*range: <=1.582
- cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <=1.565.2
Red Hat/Openshift
cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
Range: <=3.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-3gp5-92h5-h855ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2014-3664ghsaADVISORY
access.redhat.com/errata/RHBA-2014:1630ghsaWEB
access.redhat.com/errata/RHSA-2016:0070nvdWEB
access.redhat.com/security/cve/CVE-2014-3664ghsaWEB
bugzilla.redhat.com/show_bug.cginvdWEB
exchange.xforce.ibmcloud.com/vulnerabilities/96973nvdWEB
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000