CVE-2017-1000399: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Summary
CVE-2017-1000399: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.73.2
>= 2.74, < 2.84
Fixed in 2.73.2 or 2.84, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'. This package is a core component of Jenkins and is responsible for managing various tasks, including build queues. However, a vulnerability in versions 2.73.1 and earlier, as well as 2.83 and earlier, allowed unauthorized actors to access sensitive information about tasks in the queue, even if they lacked the necessary permissions. This vulnerability could potentially expose confidential data and compromise the security of Jenkins instances.
Vulnerability Detail
The vulnerability, identified as CVE-2017-1000399, allowed unauthorized actors to access information about tasks in the Jenkins build queue through the remote API. This information included details about tasks that the user did not have permission to access. The vulnerability was present in Jenkins versions 2.73.1 and earlier, as well as 2.83 and earlier. The impact of this vulnerability could vary depending on the sensitivity of the exposed information. However, it had the potential to disclose confidential data and undermine the security of Jenkins instances.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.73.22.73.2 -
>= 2.74, < 2.842.84
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can apply general security practices such as restricting access to the Jenkins instance, ensuring proper user permissions, and regularly monitoring for any unauthorized access or suspicious activities.
Conclusion
In conclusion, the vulnerability CVE-2017-1000399 in Jenkins allowed unauthorized actors to access sensitive information about tasks in the build queue. This vulnerability has been fixed in versions 2.73.2 and 2.84 of the 'org.jenkins-ci.main:jenkins-core' package. It is crucial for Jenkins users to upgrade to these fixed versions to ensure the security and integrity of their Jenkins instances. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server that facilitates continuous integration and delivery processes for software development.
The vulnerable package is 'org.jenkins-ci.main:jenkins-core', which is a core component responsible for managing various tasks in Jenkins.
The vulnerability could expose sensitive information about tasks in the Jenkins build queue, potentially compromising the security and confidentiality of the system.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the 'org.jenkins-ci.main:jenkins-core' package.
While no specific workaround is provided, general security practices such as access restriction and user permission management can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
