CVE-2017-1000394: Improper Input Validation in Jenkins
Summary
CVE-2017-1000394: Improper Input Validation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.73.2
>= 2.74, < 2.84
Fixed in 2.73.2 or 2.84, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used in the software development industry due to its flexibility and extensive plugin ecosystem. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionalities.
Vulnerability Detail
The vulnerability, known as CVE-2017-1000394, is an instance of improper input validation in Jenkins. Specifically, versions 2.73.1 and earlier, as well as 2.83 and earlier, bundled a version of the commons-fileupload library with a denial-of-service vulnerability (CVE-2016-3092). This vulnerability allows an attacker to exploit the file upload functionality in Jenkins, potentially leading to a denial-of-service attack. The fix for this vulnerability has been backported to the bundled version of the library in Jenkins.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.73.22.73.2 -
>= 2.74, < 2.842.84
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to disable or restrict access to the file upload functionality in Jenkins. This can be achieved by modifying the Jenkins configuration or using access control mechanisms to limit the privileges of users who can upload files. However, it is important to note that this workaround may impact the functionality of certain features or plugins that rely on file uploads.
Conclusion
In conclusion, the vulnerability CVE-2017-1000394 in Jenkins exposes the software to potential denial-of-service attacks. It is crucial to promptly upgrade the 'org.jenkins-ci.main:jenkins-core' package to the fixed versions or apply the provided workaround. Regularly updating Jenkins and its dependencies is also essential to ensure the overall security of the software. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
The 'org.jenkins-ci.main:jenkins-core' package is a core component of Jenkins that provides essential functionalities.
CVE-2017-1000394 is the identifier for the vulnerability in Jenkins caused by improper input validation.
This vulnerability can be exploited to perform denial-of-service attacks on Jenkins instances.
To fix this vulnerability, upgrade the 'org.jenkins-ci.main:jenkins-core' package to the recommended versions mentioned earlier.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
