CVE-2017-1000395: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Summary
CVE-2017-1000395: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.73.2
>= 2.74, < 2.84
Fixed in 2.73.2 or 2.84, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The Jenkins user accounts contain valuable information, including email addresses if the Mailer Plugin is installed. However, versions 2.73.1 and earlier, as well as 2.83 and earlier, have a vulnerability that exposes this sensitive information to unauthorized actors with Overall/Read permissions via the /user/(username)/api remote API. This vulnerability has a moderate severity rating (CVSS score: 4.3).
Vulnerability Detail
The vulnerability in Jenkins allows anyone with Overall/Read permissions to access user account information, including email addresses. This information can be obtained through the /user/(username)/api remote API. The exposed email addresses can be misused for spamming, phishing, or other malicious activities. The vulnerability affects Jenkins versions 2.73.1 and earlier, as well as 2.83 and earlier. The issue has been addressed in versions 2.73.2 and 2.84.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.73.22.73.2 -
>= 2.74, < 2.842.84
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Jenkins is not immediately feasible, a temporary workaround is to restrict Overall/Read permissions to only trusted users or administrators. This can be done by modifying the access control settings in Jenkins to limit access to the /user/(username)/api remote API.
Conclusion
The exposure of sensitive information in Jenkins user accounts can have serious consequences, including privacy breaches and potential misuse of email addresses. It is crucial to update Jenkins to the latest stable release or apply the provided workaround to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability exposes Jenkins user account information, including email addresses, to unauthorized actors. This can lead to potential privacy breaches, spamming, phishing, or other malicious activities.
Jenkins versions 2.73.1 and earlier, as well as 2.83 and earlier, are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
Yes, a temporary workaround is to restrict Overall/Read permissions to only trusted users or administrators. This can be done by modifying the access control settings in Jenkins to limit access to the /user/(username)/api remote API.
Yes, the vulnerability has been fixed in Jenkins versions 2.73.2 and 2.84. It is recommended to update to the latest stable release to ensure the fix is applied.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
