CVE-2017-1000391
Improper Input Validation in Jenkins
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Record
CVE-2017-1000391- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:N/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Record
CVE-2017-1000391- Updated
- 2026-11-02
EUVDEUVD-2022-5563 No score
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Record
EUVD-2022-5563- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wfj3-535m-p6fx
Improper Input Validation in Jenkins
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Record
GHSA-wfj3-535m-p6fx- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Record
CVE-2017-1000391- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-wfj3-535m-p6fx
Improper Input Validation in Jenkins
Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
- Record
GHSA-wfj3-535m-p6fx- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.73.2 | 2.73.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.74 to 2.88 | 2.89 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.73.3, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.73.3 |
org.jenkins-ci.main:jenkins-coreMaven |
2.74 up to 2.89, plus listed versions 2.752.762.772.782.79 Show 9 moreShow less2.802.812.822.832.842.852.862.872.88 |
2.89 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000391 is a high vulnerability (CVSS 7.3) in Jenkins, published January 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.73.3.
References
Left out here: 372 versions. The JSON record has them.