{"id":"CVE-2017-1000504","aliases":["EUVD-2022-3338","GHSA-99hj-ppg3-2xwc"],"status":"published","title":"Cross-Site Request Forgery in Jenkins","description":"A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01016,"percentile":0.63529,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2018-01-24T23:00:00Z","modified":"2026-10-24T10:30:44Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["2.89.2","2.95"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.81"},{"last_affected":"2.89.1"},{"fixed":"2.89.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.90"},{"last_affected":"2.94"},{"fixed":"2.95"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.81"},{"fixed":"2.89.2"}]}],"versions":["2.81","2.82","2.83","2.84","2.85","2.86","2.87","2.88","2.89","2.89.1"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.90"},{"fixed":"2.95"}]}],"versions":["2.90","2.91","2.92","2.93","2.94"]}],"products":[{"vendor":"jenkins","product":"jenkins"}],"references":[{"url":"https://jenkins.io/security/advisory/2017-12-14/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000504","tags":["advisory"]},{"url":"https://github.com/jenkinsci/jenkins/commit/ccc374a7176d7704941fb494589790b7673efe2","tags":["web"]},{"url":"https://jenkins.io/security/advisory/2017-12-14","tags":["web"]},{"url":"https://github.com/advisories/GHSA-99hj-ppg3-2xwc"},{"url":"https://github.com/jenkinsci/jenkins","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-1000504","description":"A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.","status":"published","published":"2018-01-24T23:00:00Z","modified":"2024-08-05T22:00:41.623Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2022-3338","description":"A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.","status":"published","published":"2018-01-24T23:00:00Z","modified":"2024-08-05T22:00:41Z","updated_at":"2026-11-03T02:23:03.159581Z"}],"ghsa":[{"id":"GHSA-99hj-ppg3-2xwc","title":"Cross-Site Request Forgery in Jenkins","description":"A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.","status":"published","published":"2022-05-14T01:04:36Z","modified":"2024-03-04T21:12:06Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2017-1000504","description":"A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.","status":"published","published":"2018-01-24T23:29:00.433Z","modified":"2026-06-17T00:59:17.603Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:04:13.257031Z"}],"osv":[{"id":"CVE-2017-1000504","description":"A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.","status":"published","published":"2018-01-24T23:29:00.433Z","modified":"2026-10-24T10:30:44.260153899Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"GHSA-99hj-ppg3-2xwc","title":"Cross-Site Request Forgery in Jenkins","description":"A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.","status":"published","published":"2022-05-14T01:04:36Z","modified":"2024-03-04T21:31:04.03861Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:43.524801Z"}]}}