UpHeron
All vulnerabilities

Servers and applications

CVE-2017-1000400

The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only lists upstream and downstream projects that the current user has access to.

Severity
Medium 4.3
Published
26 Jan 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
0.8% in the next 30 daysHigher than 57% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version up to 2.73.1
  • Every version up to 2.83

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-1000400
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-1000400