Servers and applications
CVE-2017-1000401
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation…
- Severity
- Low 2.2
- Published
- 26 Jan 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.4% in the next 30 daysHigher than 33% of CVEs. EPSS by FIRST, 11 Nov 2026
- Attack
- Needs local access · Only under certain conditions · Needs a user account · Needs someone to click or open something
- Attacker can
- Read some data
- CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N- Sources
- NVD
Description
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for is now always sent via POST, which is typically not logged.
Affected software
| Software | Affected versions |
|---|---|
JenkinsServers and applications · cpe:a:jenkins:jenkins |
|