CVE-2017-1000505: Jenkins Script Security Plugin - Exposure of Sensitive Information
Summary
CVE-2017-1000505: Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.37. Fixed in 1.37. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that allows users to execute Groovy scripts in a sandboxed environment. It provides a secure way to run custom scripts without compromising the integrity of the Jenkins master file system. The plugin is widely used in various software development and continuous integration workflows.
Vulnerability Detail
The vulnerability identified as CVE-2017-1000505 affects Jenkins Script Security Plugin versions 1.36 and earlier. It allows users with the ability to configure sandboxed Groovy scripts to exploit a type coercion feature in Groovy, enabling them to create new File objects from strings. This capability can be abused to read arbitrary files on the Jenkins master file system, potentially exposing sensitive information. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.37
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to restrict access to the Jenkins master file system and limit the privileges of users who can configure sandboxed Groovy scripts. This can be achieved by implementing proper access controls and permissions on the Jenkins server.
Conclusion
The CVE-2017-1000505 vulnerability in Jenkins Script Security Plugin exposes sensitive information to unauthorized actors. It is crucial to promptly upgrade to version 1.37 or later of the plugin to prevent potential file system breaches. Implementing proper access controls and permissions can also provide temporary mitigation. For further assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows users to read arbitrary files on the Jenkins master file system, potentially exposing sensitive information. It can be exploited by users with the ability to configure sandboxed Groovy scripts.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the recommended fix to prevent potential exploitation.
No, this vulnerability requires an authenticated user with the ability to configure sandboxed Groovy scripts. It cannot be exploited remotely without proper authentication.
The attacker needs to have the necessary permissions to configure sandboxed Groovy scripts in the Jenkins environment. Without these privileges, the vulnerability cannot be exploited.
Yes, the vulnerability has been fixed in Jenkins Script Security Plugin version 1.37. It is recommended to upgrade to this version or later to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
