CVE-2017-1000090: CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration
Summary
CVE-2017-1000090: CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration. Affects org.jenkins-ci.plugins:role-strategy versions < 2.5.1. Fixed in 2.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Role-based Authorization Strategy Plugin is a plugin for the Jenkins automation server that provides a role-based access control mechanism. It allows administrators to define roles and assign permissions to users based on those roles. This plugin is widely used in Jenkins installations to manage user access and authorization.
Vulnerability Detail
The Role-based Authorization Strategy Plugin in Jenkins did not enforce the use of POST requests for its API, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. This allowed attackers to perform unauthorized actions, such as adding the administrator role to any user or removing the authorization configuration, potentially granting them full control over the Jenkins instance. The vulnerability has a CVSS score of 8.8, indicating a high severity.
How To Fix
Latest published version: 928.vc60b_edb_fea_e1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately possible, users can mitigate the vulnerability by implementing CSRF protection at the network or application level. This can be done by adding CSRF tokens to all requests to the Jenkins instance or by configuring a web application firewall (WAF) to block malicious requests.
Conclusion
The CSRF vulnerability in the Jenkins Role-based Authorization Strategy Plugin configuration can lead to unauthorized access and potential compromise of a Jenkins instance. It is highly recommended to upgrade to version 2.5.1 or later of the plugin to fix the vulnerability. Alternatively, users can implement CSRF protection at the network or application level as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:role-strategy →
FAQ
This vulnerability allows attackers to gain unauthorized access to a Jenkins instance and potentially perform malicious actions, such as modifying configurations or accessing sensitive information.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is recommended to apply the fix as soon as possible to prevent any potential attacks.
No, only versions prior to 2.5.1 are affected. Users should upgrade to version 2.5.1 or later to fix the vulnerability.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the Jenkins instance.
Yes, users can mitigate the vulnerability by implementing CSRF protection at the network or application level, as mentioned in the 'workaround' section of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:role-strategy.
