CVE-2017-2599: Incorrect Authorization in Jenkins
Summary
CVE-2017-2599: Incorrect Authorization in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used for continuous integration and delivery. The vulnerable package, org.jenkins-ci.main:jenkins-core, is a core component of Jenkins that provides essential functionality for managing jobs and workflows.
Vulnerability Detail
The vulnerability, identified as CVE-2017-2599, is an insufficient permission check in Jenkins versions before 2.44 and 2.32.2. It allows users with permissions to create new items (e.g., jobs) to overwrite existing items they don't have access to. This security flaw, known as SECURITY-321, can be exploited by malicious users to gain unauthorized access to sensitive information or disrupt the normal operation of Jenkins.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading Jenkins to the patched versions.
Conclusion
The vulnerability in Jenkins (CVE-2017-2599) allows users with certain permissions to overwrite existing items they don't have access to. This can lead to unauthorized access to sensitive information or disruption of Jenkins' functionality. It is crucial to upgrade Jenkins to version 2.44 or 2.32.2 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery. It helps developers automate the building, testing, and deployment of their software projects.
This vulnerability allows users with certain permissions to overwrite existing items they don't have access to. It can lead to unauthorized access to sensitive information or disruption of Jenkins' functionality.
You can use Vulert's playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
No, there are no known workarounds for this vulnerability. It is essential to upgrade Jenkins to the patched versions.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
