CVE-2014-3663: Arbitrary Job Creation and Destruction in Jenkins
Summary
CVE-2014-3663: Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.565.3
>= 1.566, < 1.583
Fixed in 1.565.3 or 1.583, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and features to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for job management and configuration.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3663, allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs within Jenkins. This vulnerability affects Jenkins versions before 1.583 and LTS versions before 1.565.3. The specific vectors through which this bypass can be achieved are not disclosed in the available information.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.565.31.565.3 -
>= 1.566, < 1.5831.583
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround is mentioned in the available information. However, users can mitigate the risk by ensuring that only trusted and authorized users have the Job/CONFIGURE permission in Jenkins. Additionally, regular monitoring of job configurations and access logs can help detect any unauthorized activity.
Conclusion
In conclusion, the vulnerability CVE-2014-3663 in Jenkins allows authenticated users with the Job/CONFIGURE permission to create or destroy arbitrary jobs. To mitigate this risk, it is crucial to upgrade Jenkins to the recommended versions or apply the provided patches. Regular monitoring and access control are also essential to detect and prevent unauthorized activity. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows authenticated users with the Job/CONFIGURE permission to create or destroy arbitrary jobs within Jenkins, potentially leading to unauthorized access, data loss, or disruption of the CI/CD process.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any known vulnerabilities, including CVE-2014-3663.
No specific information about known exploits is provided in the available details. However, it is crucial to promptly apply the recommended updates to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely by authenticated users with the Job/CONFIGURE permission. It does not require physical access to the Jenkins server.
The available information does not mention any evidence of active exploitation in the wild. However, it is always recommended to apply security updates promptly to minimize the risk of potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
