CVE-2017-1000393: OS Command Injection in Jenkins
Summary
CVE-2017-1000393: OS Command Injection in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.73.2
>= 2.74, < 2.84
Fixed in 2.73.2 or 2.84, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
The vulnerability, identified as CVE-2017-1000393, allows users with permission to create or configure agents in Jenkins to exploit a command injection flaw. Specifically, users could configure a launch method called 'Launch agent via execution of command on master', which would execute arbitrary shell commands on the master node whenever the agent was launched. This could lead to unauthorized access, data leakage, or even complete compromise of the Jenkins server. The vulnerability has a CVSS score of 8.8 (High).
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.73.22.73.2 -
>= 2.74, < 2.842.84
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by following the steps mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the CVE-2017-1000393 vulnerability in Jenkins allows unauthorized users to execute arbitrary shell commands on the server. It is crucial to upgrade to the latest version and restrict the 'Run Scripts' permission to prevent exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects.
The vulnerable package is 'org.jenkins-ci.main:jenkins-core'.
The vulnerability allows unauthorized users to execute arbitrary shell commands on the Jenkins server, potentially leading to unauthorized access, data leakage, or server compromise.
The CVSS score of this vulnerability is 8.8 (High).
To fix this vulnerability, upgrade your Jenkins installation to version 2.73.2 or later and ensure that the 'Run Scripts' permission is only granted to administrators.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
