What is CVE-2014-2064?

CVE-2014-2064 is a vulnerability in Jenkins, classified under Information Disclosure. Published 2014-10-17.

Is CVE-2014-2064 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Jenkins

CVE-2014-2064

The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

Vulnerability class: Information Disclosure

EPSS: 0.030 (85.7th percentile) — read the EPSS interpretation.

Affected products

Jenkins
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

References

security@debian.org (x_refsource_CONFIRM, Patch)
security@debian.org (mailing-list, x_refsource_MLIST)
security@debian.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2014-2064?: CVE-2014-2064 is a vulnerability in Jenkins, classified under Information Disclosure. Published 2014-10-17.
Is CVE-2014-2064 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.