CVE-2017-2601: Cross-site Scripting in Jenkins
Summary
CVE-2017-2601: Cross-site Scripting in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that allows developers to build, test, and deploy software projects. It is widely used in the software development industry and provides a range of features for continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
Jenkins versions before 2.44 and 2.32.2 are susceptible to a persisted cross-site scripting (XSS) vulnerability. This vulnerability allows users with job configuration permissions to inject malicious JavaScript code into parameter names and descriptions. An attacker could exploit this vulnerability to execute arbitrary code within the context of the affected user's browser, potentially leading to unauthorized actions or data theft.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, users can implement a workaround by sanitizing user input in parameter names and descriptions. This can be achieved by validating and encoding user-supplied data to prevent the execution of malicious scripts. Here is an example of how to sanitize user input in Java:
import org.apache.commons.lang.StringEscapeUtils;
String sanitizedInput = StringEscapeUtils.escapeHtml(userInput);
This code snippet uses the Apache Commons Lang library to escape HTML characters and prevent script execution.
Conclusion
In conclusion, Jenkins versions before 2.44 and 2.32.2 are vulnerable to a persisted cross-site scripting (XSS) vulnerability. It is crucial for users to upgrade their Jenkins installation to the latest secure version or implement input sanitization to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code within the context of the affected user's browser. Depending on the permissions of the user, this could lead to unauthorized actions, data theft, or further exploitation of the system.
Users of Jenkins versions before 2.44 and 2.32.2 are affected by this vulnerability. Specifically, users with job configuration permissions are at risk.
The recommended mitigation is to upgrade Jenkins to version 2.44 or 2.32.2, which include the necessary security patches. Alternatively, users can implement input sanitization to prevent script execution.
There is no specific evidence of active exploits targeting this vulnerability at this time. However, it is important to promptly apply the recommended security updates to mitigate the risk.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-r69c-5j7c-vm6q or the associated CVE-2017-2601.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
