CVE-2017-1000504
High
Description
A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Jenkins
PublishedJan 24, 2018
First seenJan 24, 2018
How to fix
Update
- org.jenkins-ci.main:jenkins-core2.89.2, 2.95 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins jenkins | v ≤ 2.89.1, v ≤ 2.94 | — |
| org.jenkins-ci.main:jenkins-coreMaven | 2.81 ≤ v < 2.89.2, 2.90 ≤ v < 2.95 | 2.89.2, 2.95 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.