CVE-2017-2602: Incomplete List of Disallowed Inputs in Jenkins
Summary
CVE-2017-2602: Incomplete List of Disallowed Inputs in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development processes. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The vulnerability (CVE-2017-2602) in Jenkins versions before 2.44 and 2.32.2 arises from an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This flaw allows malicious agents to write metadata files, potentially leading to unauthorized access or manipulation of sensitive information. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually restrict access to the affected metadata files by modifying the file permissions or implementing access control mechanisms. However, applying the official update is the recommended solution to fully mitigate the vulnerability.
Conclusion
In conclusion, the vulnerability (CVE-2017-2602) in Jenkins allows malicious agents to write metadata files, potentially leading to unauthorized access or manipulation of sensitive information. It is crucial to update Jenkins to version 2.44 or 2.32.2 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects. It provides a wide range of features and integrations to support continuous integration and delivery processes.
The vulnerable package is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionality.
This vulnerability allows malicious agents to write metadata files in Jenkins, potentially leading to unauthorized access or manipulation of sensitive information.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to update Jenkins to version 2.44 or 2.32.2, depending on the currently installed version.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
