CVE-2017-2609: Information Disclosure in Jenkins
Summary
CVE-2017-2609: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development processes. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionalities.
Vulnerability Detail
The vulnerability, identified as CVE-2017-2609, is an information disclosure issue in Jenkins. Prior to versions 2.44 and 2.32.2, the autocomplete feature in the search box of Jenkins' search suggestions (SECURITY-385) inadvertently exposed sensitive information. Specifically, the autocomplete feature would suggest the names of views, even those that the current user did not have access to. This could potentially allow an unauthorized actor to gain insights into the organization's Jenkins configuration and view sensitive information.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can disable the autocomplete feature in the search box to prevent the disclosure of sensitive information. This can be achieved by modifying the Jenkins configuration or using plugins that provide additional security measures. However, it is strongly advised to apply the official fix by upgrading to the patched versions.
Conclusion
In conclusion, CVE-2017-2609 is an information disclosure vulnerability in Jenkins that exposes sensitive information through the autocomplete feature in search suggestions. It is crucial to upgrade to the patched versions (2.44 or 2.32.2) to mitigate the risk of unauthorized access to sensitive information. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows an unauthorized actor to obtain information about Jenkins views, potentially exposing sensitive information and compromising the security of the system.
No, only versions prior to 2.44 and 2.32.2 are affected by this specific vulnerability. It is recommended to upgrade to the latest patched version.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the fix as soon as possible to mitigate any potential risks.
Yes, the vulnerability can be exploited remotely by an unauthorized actor without requiring any authentication.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
