CVE-2017-2610: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2017-2610: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used for continuous integration and delivery. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
The vulnerability (CVE-2017-2610) in Jenkins versions before 2.44 and 2.32.2 is related to a persisted cross-site scripting (XSS) issue in search suggestions. The vulnerability arises due to the improper escaping of users with less-than and greater-than characters in their names. This vulnerability is tracked as SECURITY-388. An attacker can exploit this vulnerability to inject malicious scripts into the search suggestions, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the search suggestions feature in Jenkins. This can be done by modifying the Jenkins configuration or disabling the corresponding plugin responsible for search suggestions. However, it is strongly advised to apply the official fix by upgrading to the patched version.
Conclusion
The vulnerability (CVE-2017-2610) in Jenkins versions before 2.44 and 2.32.2 allows for persisted cross-site scripting (XSS) attacks. It is crucial to upgrade Jenkins to the fixed version or apply the workaround to mitigate the risk of unauthorized access and potential data theft. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
No, only versions before 2.44 and 2.32.2 are vulnerable to this specific issue. It is recommended to check the installed version and apply the appropriate fix.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is crucial to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by an attacker who can interact with the affected Jenkins instance.
No, upgrading to the fixed version is the recommended solution. Applying the official fix ensures that the vulnerability is properly addressed.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
