CVE-2017-2607: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2017-2607: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that allows developers to build, test, and deploy their software projects. It provides a wide range of plugins to extend its functionality and support various development processes. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its basic functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2017-2607, is a persisted cross-site scripting (XSS) vulnerability in the console notes feature of Jenkins. This feature allows plugins to annotate build logs, adding or modifying content while a build is running. Malicious users with access to Jenkins or the source code repository can exploit this vulnerability by configuring jobs or modifying build scripts to print serialized console notes that execute XSS attacks on users viewing the build logs. This can lead to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Jenkins is not immediately feasible, a temporary workaround is to disable the console notes feature. This can be done by modifying the Jenkins configuration or disabling specific plugins that utilize the console notes functionality. However, this workaround may impact the functionality of certain plugins or limit the ability to track build progress through build logs.
Conclusion
The vulnerability CVE-2017-2607 in Jenkins exposes users to the risk of cross-site scripting attacks through the console notes feature. It is crucial to update Jenkins to versions 2.32.2 or later to mitigate this vulnerability. Additionally, keeping all plugins up to date is essential to minimize the risk of other vulnerabilities. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects. It provides a wide range of plugins to extend its functionality and support various development processes.
The 'org.jenkins-ci.main:jenkins-core' package is a core component of Jenkins that provides its basic functionality. It is responsible for managing builds, job scheduling, and other core features.
A persisted cross-site scripting (XSS) vulnerability is a type of security vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. In the case of this vulnerability, the attacker can exploit the console notes feature in Jenkins to execute XSS attacks on users viewing build logs.
Malicious users with access to Jenkins or the source code repository can exploit this vulnerability by configuring jobs or modifying build scripts to print serialized console notes that execute XSS attacks on users viewing the build logs.
This vulnerability can lead to unauthorized access, data theft, or other malicious activities. Attackers can use the XSS attacks to steal sensitive information, manipulate the behavior of Jenkins, or perform actions on behalf of other users.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
