CVE-2017-1000401: Input Validation
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for <f:password/> is now always sent via POST, which is typically not logged.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000401?
CVE-2017-1000401 has a medium severity rating due to the potential exposure of sensitive information through HTTP access logs.
How do I fix CVE-2017-1000401?
To fix CVE-2017-1000401, upgrade Jenkins to version 2.73.2 or 2.83.1 or later.
What are the affected versions in CVE-2017-1000401?
CVE-2017-1000401 affects Jenkins versions 2.73.1 and earlier, as well as 2.83 and earlier.
What does CVE-2017-1000401 entail?
CVE-2017-1000401 involves the leakage of secrets through GET requests in form validation, which can lead to sensitive information being logged.
Is CVE-2017-1000401 a critical vulnerability?
CVE-2017-1000401 is not classified as critical; it is considered medium severity and thus should be addressed but is not an immediate threat.