Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Also known as GHSA-x55p-6526-xmmp

Published 8 y ago 2018-05-15 · modified 4 mo ago 2026-06-17 · JSON

CVSS

2.6

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.0%

percentile 63%

Public exploits

none known

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).

Exploit prediction (EPSS)

1.00% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	2.6	`CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N`
CNA	3.0	2.6	`CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N`
NVD	3.0	3.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:P/I:N/A:N`
GitHub	3.0	3.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.jenkins-ci.main:jenkins-core`	<2.32.2 >=2.34, <2.44	2.32.2 2.44

Affected products

[UNKNOWN] jenkins

Classification

Weakness

CWE-325 Missing Cryptographic Step
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Technology feeds

Jenkins (RSS, critical only)

References

jenkins.io /security/advisory/2017-02-01/ · x_refsource_CONFIRM, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2603 · x_refsource_CONFIRM, x_transferred
github.com /jenkinsci/jenkins/commit/3cd946cbef82c6da5ccccf3890d0ae4e091c4265 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/95955 · vdb-entry, x_refsource_BID, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-2603 · advisory
github.com /jenkinsci/jenkins · package
jenkins.io /security/advisory/2017-02-01 · web

Sources

CVE List: CVE-2017-2603
GitHub Advisory: GHSA-x55p-6526-xmmp
NVD: CVE-2017-2603

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary