CVE-2014-3662: Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability in org.jenkins-ci.main:jenkins-core
Summary
CVE-2014-3662: Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.565.3
>= 1.566, < 1.583
Fixed in 1.565.3 or 1.583, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package, org.jenkins-ci.main:jenkins-core, is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The vulnerability identified as CVE-2014-3662 affects Jenkins versions before 1.583 and LTS versions before 1.565.3. It allows remote attackers to enumerate user names by exploiting weaknesses related to login attempts. This means that an unauthorized actor could gather sensitive information about valid user accounts, potentially leading to further security breaches or unauthorized access to the system.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.565.31.565.3 -
>= 1.566, < 1.5831.583
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the recommended fix by updating the vulnerable package to a secure version.
Conclusion
The vulnerability CVE-2014-3662 exposes sensitive information to unauthorized actors in the org.jenkins-ci.main:jenkins-core package. To mitigate this vulnerability, it is crucial to update the package to a secure version. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects.
org.jenkins-ci.main:jenkins-core is a core component of Jenkins that provides fundamental functionality.
The vulnerability allows unauthorized actors to enumerate user names, potentially leading to further security breaches or unauthorized access to the system.
To fix this vulnerability, update the org.jenkins-ci.main:jenkins-core package to a secure version (1.583 or later for non-LTS versions, 1.565.3 or later for LTS versions).
There is no specific workaround mentioned for this vulnerability. It is important to apply the recommended fix by updating the vulnerable package.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
