CVE-2014-3680: Jenkins Exposure of Sensitive Information to an Unauthorized Actor
Summary
CVE-2014-3680: Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.565.3
>= 1.566, < 1.583
Fixed in 1.565.3 or 1.583, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3680, exists in Jenkins versions before 1.583 and LTS before 1.565.3. It allows remote authenticated users with the Job/READ permission to access the default value for the password field of a parameterized job by reading the Document Object Model (DOM). This exposure of sensitive information can lead to unauthorized access and potential misuse of credentials or other confidential data.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.565.31.565.3 -
>= 1.566, < 1.5831.583
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to restrict the Job/READ permission for authenticated users. By limiting access to the vulnerable functionality, the risk of unauthorized information exposure can be mitigated. Here is an example of how to restrict the permission using the Jenkins Script Console:
import jenkins.model.Jenkins;
import hudson.security.Permission;
def jenkins = Jenkins.getInstance()
jenkins.getAuthorizationStrategy().getACL(Jenkins.ADMINISTER).remove(Permission.READ)
jenkins.save()
Please note that this workaround is not a permanent solution and should be followed by upgrading to the recommended Jenkins versions.
Conclusion
In conclusion, the CVE-2014-3680 vulnerability in Jenkins exposes sensitive information to unauthorized actors. It is crucial to upgrade Jenkins to the recommended versions or apply the temporary workaround to mitigate the risk of unauthorized access. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects. It provides a wide range of features and plugins to support the development lifecycle.
The vulnerability allows remote authenticated users to access the default value of a password field in a parameterized job. This can lead to unauthorized access and potential misuse of sensitive information.
Users of Jenkins versions before 1.583 and LTS before 1.565.3 are affected by this vulnerability. Specifically, remote authenticated users with the Job/READ permission are able to exploit the vulnerability.
To fix this vulnerability, it is recommended to upgrade Jenkins to version 1.583 or later for non-LTS releases, or version 1.565.3 or later for LTS releases. This will include the necessary patches to address the vulnerability.
A temporary workaround is to restrict the Job/READ permission for authenticated users. This can be done by modifying the Jenkins authorization strategy. However, upgrading to the recommended Jenkins versions is the recommended long-term solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
