UpHeron
All vulnerabilities

Servers and applications

CVE-2017-1000354

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and…

Severity
High 8.8
Published
29 Jan 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.2% in the next 30 daysHigher than 68% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Improper authentication (CWE-287)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance.

From NVD.

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version up to 2.56
  • Every version up to 2.46.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-1000354
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-1000354