CVE-2017-2612: Incorrect Permission Assignment for Critical Resource in Jenkins
Summary
CVE-2017-2612: Incorrect Permission Assignment for Critical Resource in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that allows developers to build, test, and deploy their software projects. It is widely used in the software development industry for continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its main functionality.
Vulnerability Detail
The vulnerability identified as CVE-2017-2612 in Jenkins versions before 2.44 and 2.32.2 allows low privilege users to override JDK download credentials. This means that users with limited privileges can modify the settings for downloading Java Development Kits (JDKs) used in the build process. As a result, future builds may fail to download the required JDK, leading to build failures and potential disruptions in the software development workflow.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to restrict access to the Jenkins instance and ensure that only trusted users with sufficient privileges can modify the JDK download credentials. This can be achieved by adjusting the user permissions and access controls within the Jenkins configuration.
Conclusion
In conclusion, the vulnerability CVE-2017-2612 in Jenkins allows low privilege users to override JDK download credentials, potentially leading to build failures. To fix this vulnerability, it is recommended to upgrade Jenkins to version 2.44 or above. If immediate upgrading is not possible, restricting access to the Jenkins instance and ensuring trusted users can modify JDK download credentials can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows low privilege users to tamper with JDK download credentials, potentially leading to build failures and disruptions in the software development process.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There is no known exploit publicly available for this vulnerability at the time of this report. However, it is essential to address the vulnerability promptly to mitigate any potential risks.
While upgrading Jenkins to a fixed version is the recommended solution, you can temporarily mitigate the vulnerability by restricting access to the Jenkins instance and ensuring only trusted users can modify the JDK download credentials.
There may be other vulnerabilities in Jenkins that are not directly related to this specific issue. It is crucial to regularly update Jenkins and monitor security advisories to stay protected against any potential vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.