GCVE - cpe:2.3:a:unspecified:jenkins:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unspecified:jenkins:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unspecified (`6e0c47d7-4a6a-5e77-bb8d-ada54d9c4fcb`)
Product	Jenkins (`b5355ce4-2edc-5456-96da-272ab465d500`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-2611`	vulnerable	2026-06-08 05:09:24.726855	Details available MEDIUM (4.3) Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents. Published: 2018-05-08T18:00:00.000Z Updated: 2024-08-05T14:02:06.500Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2017-02-01/ http://www.securityfocus.com/bid/95956 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611 https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-2606`	vulnerable	2026-06-08 05:09:24.724741	Details available MEDIUM (4.3) Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction. Published: 2018-05-08T20:00:00.000Z Updated: 2024-08-05T14:02:06.482Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2017-02-01/ https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2606 https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51266b63719 http://www.securityfocus.com/bid/95962	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-2601`	vulnerable	2026-06-08 05:09:24.722910	Details available MEDIUM (6.1) Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions. Published: 2018-05-10T00:00:00.000Z Updated: 2024-08-05T14:02:06.982Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2017-02-01/ https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2601 http://www.securityfocus.com/bid/95960 https://github.com/jenkinsci/jenkins/commit/fd2e081b947124c90bcd97bfc55e1a7f2ef41a74 http://www.openwall.com/lists/oss-security/2022/04/12/5	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.