CVE-2017-2600 json
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
published 2018-05-15 8 y ago modified 2026-06-17 4 mo ago also GHSA-wj5c-j656-h5fw , EUVD-2022-5584
- cvss
- 4.3
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
Patch / fix
- maven org.jenkins-ci.main:jenkins-core 2.32.2, 2.44
- jenkins jenkins 2.32.2, 2.44
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-2600 updated cvss 4.3
jenkins: Node monitor data could be viewed by low privilege users (SECURITY-343)
-
Red Hat OpenShift Enterprise 2 jenkins Red Hat OpenShift Enterprise 3 jenkinsunder investigation
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | <2.32.2 >=2.34, <2.44 |
2.32.2 2.44 |
Affected products
- [UNKNOWN] jenkins
Classification
- Weakness
- Technology feeds
References
-
github.com
/jenkinsci/jenkins/commit/0f92cd08a19207de2cceb6a2f4e3e9f92fdc0899
web, patch
-
bugzilla.redhat.com
/show_bug.cgi?id=CVE-2017-2600
web, issue-tracking, patch
-
jenkins.io
/security/advisory/2017-02-01/
vendor-advisory
-
securityfocus.com
/bid/95954
vdb-entry, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-2600
advisory
-
github.com
/jenkinsci/jenkins
package
-
jenkins.io
/security/advisory/2017-02-01
web
Sources
- CVE List CVE-2017-2600
- GitHub Advisory GHSA-wj5c-j656-h5fw
- NVD CVE-2017-2600
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.