Jenkin allows attackers to obtain passwords by reading the HTML source code

MEDIUM 5.0CVE-2014-2061 · GHSA-rxfv-gm5x-9wqj · Published 17/10/2014 · updated 17/06/2026

In short

CVE-2014-2061 is a MEDIUM (CVSS 5.0) vulnerability affecting org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.3% of all vulnerabilities.
Fix: update to 1.551, 1.532.2 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 1.533, < 1.551< 1.532.2`	`1.5511.532.2`
jenkins jenkins	`≤ 1.532.1≤ 1.550`	No fix yet

Description

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-2061 · ADVISORY
jenkinsci/jenkins commit bf53919 · WEB
jenkinsci/jenkins · PACKAGE
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 · WEB
openwall.com/lists/oss-security/2014/02/21/2 · WEB

More vulnerabilities in org.jenkins-ci.main:jenkins-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.main:jenkins-core

Maven

≥ 1.533, < 1.551< 1.532.2

1.5511.532.2

jenkins

≤ 1.532.1≤ 1.550

No fix yet

Description

NVD description

More vulnerabilities in org.jenkins-ci.main:jenkins-core

See all →