CVE-2014-2058
Jenkins allows attackers to execute arbitrary jobs
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
Exploit likelihood
What each source reports
NVD Score used
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
- Record
CVE-2014-2058- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
- Record
CVE-2014-2058- Updated
- 2026-11-02
EUVDEUVD-2022-2988 No score
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
- Record
EUVD-2022-2988- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7fpg-pp3m-h22f No score
Jenkins allows attackers to execute arbitrary jobs
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
- Record
GHSA-7fpg-pp3m-h22f- Updated
- 2026-11-02
OSVGHSA-7fpg-pp3m-h22f No score
Jenkins allows attackers to execute arbitrary jobs
BuildTrigger in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to bypass access restrictions and execute arbitrary jobs by configuring a job to trigger another job. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7330.
- Record
GHSA-7fpg-pp3m-h22f- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
1.533 up to 1.551 | 1.551 |
org.jenkins-ci.main:jenkins-coreMaven |
before 1.532.2 | 1.532.2 |
org.jenkins-ci.main:jenkins-coreMaven |
1.533 up to 1.551, plus listed versions 1.5341.5351.5361.5371.538 Show 12 moreShow less1.5391.5401.5411.5421.5431.5441.5451.5461.5471.5481.5491.550 |
1.551 |
org.jenkins-ci.main:jenkins-coreMaven |
before 1.532.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
1.532.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2058 is a medium vulnerability (CVSS 6.5) in Jenkins, published October 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.551.
References
github.com/jenkinsci/jenkins/commit/b6b2a367a7976be80a799c6a49fa6c58d778b50e
openwall.com/lists/oss-security/2014/02/21/2
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14
nvd.nist.gov/vuln/detail/CVE-2014-2058
Left out here: 113 versions. The JSON record has them.