CVE-2017-1000504: Cross-Site Request Forgery in Jenkins
Summary
CVE-2017-1000504: Cross-Site Request Forgery in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
>= 2.81, < 2.89.2
>= 2.90, < 2.95
Fixed in 2.89.2 or 2.95, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development processes. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective. This vulnerability allows an attacker to trick a user into performing unwanted actions on their behalf, potentially leading to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.81, < 2.89.22.89.2 -
>= 2.90, < 2.952.95
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is to disable CSRF protection in Jenkins. This can be done by navigating to the 'Configure Global Security' page in the Jenkins web interface, unchecking the 'Enable Cross Site Request Forgery protection' option, and saving the changes. However, this workaround should only be considered as a temporary measure until the package can be updated to a secure version.
Conclusion
In conclusion, the 'org.jenkins-ci.main:jenkins-core' package is vulnerable to a Cross-Site Request Forgery (CSRF) issue that can allow unauthorized actions on behalf of users. It is crucial to upgrade to a secure version or apply the provided workaround to mitigate the risk. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
Cross-Site Request Forgery (CSRF) is an attack that tricks a user into performing unwanted actions on a web application in which they are authenticated.
This vulnerability can allow an attacker to perform unauthorized actions on behalf of a Jenkins user, potentially leading to data manipulation, unauthorized access, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade the 'org.jenkins-ci.main:jenkins-core' package to a secure version as mentioned in the 'how_to_fix' section.
Yes, a temporary workaround is to disable CSRF protection in Jenkins. Please refer to the 'workaround' section for detailed instructions.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
