UpHeron
All vulnerabilities

Servers and applications

CVE-2017-1000393

Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of this launch method now requires the Run Scripts permission…

Severity
High 8.8
Published
26 Jan 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.6% in the next 30 daysHigher than 85% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
OS command injection (CWE-78)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Description

Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of this launch method now requires the Run Scripts permission typically only granted to administrators.

From NVD.

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version up to 2.73.1
  • Every version up to 2.83

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-1000393
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-1000393