CVE-2017-1000096

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10000977.5On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that CVE-2017-10000987.5The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "m CVE-2017-10000996.5When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The CVE-2017-100017.6Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Core). The suppor CVE-2017-10001006.5When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name CVE-2017-10001016.5curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of CVE-2017-10001025.4The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Maliciou CVE-2017-10001035.4The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability:CVE-2017-10001046.5The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with on CVE-2017-10001055.3The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before prov CVE-2017-10001068.5Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches co CVE-2017-10001078.8Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor inv