CVE-2017-1000398: Infoleak
The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only shows information about accessible tasks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000398?
CVE-2017-1000398 has been rated as a high-severity vulnerability due to its potential exposure of sensitive information.
How do I fix CVE-2017-1000398?
To fix CVE-2017-1000398, you should upgrade Jenkins to version 2.73.2 or 2.83.1 or later.
What does CVE-2017-1000398 affect?
CVE-2017-1000398 affects Jenkins versions 2.73.1 and earlier, as well as 2.83 and earlier.
What kind of information does CVE-2017-1000398 expose?
CVE-2017-1000398 exposes information about tasks currently running on Jenkins agents that users should not have access to.
Can CVE-2017-1000398 lead to unauthorized access?
Yes, CVE-2017-1000398 can lead to unauthorized access to build information due to improper permission checks.