CVE-2017-1000504
Last modified
CVE-2017-1000504 is a vulnerability of currently unknown severity. A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.. EPSS estimates a 1.04% chance of exploitation in the next 30 days.
Description
A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Jenkins | <= 2.89.1 |
| Jenkins | Jenkins | <= 2.94 |
References
- https://jenkins.io/security/advisory/2017-12-14/Vendor Advisory
- https://jenkins.io/security/advisory/2017-12-14/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-1000504?
How severe is CVE-2017-1000504?
How do I fix CVE-2017-1000504?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-1000499phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulne…
- CVE-2017-10005Vulnerability in the Oracle FLEXCUBE Private Banking compone…
- CVE-2017-1000500Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2017-1000501Awstats version 7.6 and earlier is vulnerable to a path trav…
- CVE-2017-1000502Users with permission to create or configure agents in Jenki…
- CVE-2017-1000503A race condition during Jenkins 2.81 through 2.94 (inclusive…
- CVE-2017-1000505In Jenkins Script Security Plugin version 1.36 and earlier, …
- CVE-2017-1000506Mautic version 2.11.0 and earlier contains a Cross Site Scri…
- CVE-2017-1000507Canvs Canvas version 3.4.2 contains a Cross Site Scripting (…
- CVE-2017-1000508Invoice Plane version 1.5.4 and earlier contains a Cross Sit…
- CVE-2017-1000509Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS)…
- CVE-2017-1000510Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scrip…
Are you affected by CVE-2017-1000504?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST