CVE-2017-1000400: Missing Authorization in Jenkins
Summary
CVE-2017-1000400: Missing Authorization in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.73.2
>= 2.74, < 2.84
Fixed in 2.73.2 or 2.84, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that allows developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is org.jenkins-ci.main:jenkins-core. This package is a core component of Jenkins and is responsible for handling various functionalities, including the remote API.
Vulnerability Detail
The Jenkins remote API in versions 2.73.1 and earlier, 2.83 and earlier, contained a missing authorization vulnerability. Specifically, the API endpoint at /job/(job-name)/api exposed information about upstream and downstream projects, even if the current user did not have the necessary permissions to access them. This could lead to unauthorized access to sensitive information and potential security breaches. The vulnerability has been addressed in versions 2.73.2 and 2.84, where the API now only lists upstream and downstream projects that the current user has access to.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.73.22.73.2 -
>= 2.74, < 2.842.84
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround is to restrict access to the affected API endpoint (/job/(job-name)/api) by configuring appropriate access controls or firewall rules. This can help mitigate the risk of unauthorized access to sensitive information.
Conclusion
The missing authorization vulnerability in Jenkins (CVE-2017-1000400) exposes sensitive information about upstream and downstream projects to unauthorized users. It is crucial to upgrade to the fixed versions (2.73.2 or 2.84) or apply appropriate access controls to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects. It provides a wide range of features and plugins to support the development and deployment processes.
The vulnerable package is org.jenkins-ci.main:jenkins-core, which is a core component of Jenkins responsible for handling various functionalities, including the remote API.
The vulnerability allows unauthorized access to information about upstream and downstream projects in Jenkins, potentially exposing sensitive data and leading to security breaches.
To fix this vulnerability, upgrade your Jenkins installation to version 2.73.2 or 2.84. Update the org.jenkins-ci.main:jenkins-core package in your project's Maven configuration file (pom.xml) and rebuild/redeploy your Jenkins instance.
Yes, you can restrict access to the vulnerable API endpoint (/job/(job-name)/api) by configuring appropriate access controls or firewall rules until you can upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
