CVE-2017-1000392: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2017-1000392: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.73.3
>= 2.74, < 2.89
Fixed in 2.73.3 or 2.89, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core'. This package is a core component of Jenkins and is responsible for handling various functionalities of the server.
Vulnerability Detail
The vulnerability identified as CVE-2017-1000392 is an instance of improper neutralization of input during web page generation in Jenkins. Versions 2.88 and earlier, as well as 2.73.2 and earlier, are affected by this vulnerability. The issue arises from the improper handling of autocompletion suggestions for text fields, which were not properly escaped. This allows for a persisted cross-site scripting (XSS) vulnerability if the source for the suggestions allows specifying text that includes HTML metacharacters like less-than and greater-than characters. An attacker can exploit this vulnerability to inject malicious scripts into the web page, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.73.32.73.3 -
>= 2.74, < 2.892.89
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround can be implemented. This workaround involves disabling autocompletion suggestions for text fields in Jenkins. By disabling this feature, the vulnerability can be mitigated until the package is updated. The following code snippet demonstrates how to disable autocompletion suggestions:
System.setProperty('hudson.model.DirectoryBrowserSupport.CSP', '')
Conclusion
In conclusion, the vulnerability identified as CVE-2017-1000392 in the 'org.jenkins-ci.main:jenkins-core' package allows for a persisted cross-site scripting (XSS) attack. Upgrading to the fixed versions or implementing the provided workaround will mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server that facilitates continuous integration and delivery. It provides developers with a platform to build, test, and deploy their software projects efficiently.
'org.jenkins-ci.main:jenkins-core' is a core component of Jenkins. It is responsible for handling various functionalities of the Jenkins server, including the generation of web pages and user interfaces.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, and other malicious activities.
This vulnerability can be exploited by an attacker who can provide input for autocompletion suggestions in text fields. If the input includes HTML metacharacters like less-than and greater-than characters, the attacker can inject malicious scripts into the web page, potentially compromising user data and system security.
The impact of this vulnerability includes the potential for unauthorized access, data theft, and other malicious activities. By injecting malicious scripts into the web page, an attacker can manipulate the behavior of the Jenkins server and compromise the security of user data.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
