CVE-2017-1000504

A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.

Published: Jan 25, 2018
Updated: May 9, 2024
CVE: CVE-2017-1000504
GHSA: GHSA-99hj-ppg3-2xwc
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-352

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.89.1.x
jenkins / jenkins	-	2.94.x
org.jenkins-ci.main / jenkins-core	2.81	2.89.2
org.jenkins-ci.main / jenkins-core	2.90	2.95

https://jenkins.io/security/advisory/2017-12-14/

Vulnerability Database

289,697

CVE-2017-1000504