VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 26, 2018· Updated Aug 5, 2024

CVE-2017-1000392

CVE-2017-1000392

Description

Jenkins autocompletion suggestions were not escaped, allowing persistent XSS via specially crafted suggestion text in affected versions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins autocompletion suggestions were not escaped, allowing persistent XSS via specially crafted suggestion text in affected versions.

Vulnerability

Jenkins 2.88 and earlier, and LTS 2.73.2 and earlier, contain a persistent cross-site scripting vulnerability in the autocompletion functionality for text fields. The suggestions were not escaped, allowing injection of HTML metacharacters [1]. Known sources for these suggestions include logger names in log recorder conditions and agent labels [4].

Exploitation

An attacker can inject malicious HTML or JavaScript by manipulating the source of autocompletion suggestions (e.g., by creating a logger or agent with a specially crafted name). When another user interacts with a text field that uses autocomplete, the injected script executes in their browser [4].

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the Jenkins user interface, potentially leading to session hijacking, credential theft, or actions performed on behalf of the victim.

Mitigation

The vulnerability is fixed in Jenkins weekly 2.89 and LTS 2.73.3 [4]. Users should upgrade to these versions or later. There are no known workarounds for unpatched versions.

References
  1. NVD - CVE-2017-1000392
  2. Jenkins Security Advisory 2017-11-08

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.main:jenkins-coreMaven
< 2.73.32.73.3
org.jenkins-ci.main:jenkins-coreMaven
>= 2.74, < 2.892.89

Affected products

1

Patches

1
f67068170b55

[SECURITY-641] Escape autocompletion suggestions

https://github.com/jenkinsci/jenkinsDaniel BeckOct 24, 2017via ghsa
commit
1 file changed · +1 −0
  • war/src/main/webapp/scripts/hudson-behavior.js+1 −0 modified
    @@ -712,6 +712,7 @@ var jenkinsRules = {
         };
         ac.prehighlightClassName = "yui-ac-prehighlight";
         ac.animSpeed = 0;
+        ac.formatResult = ac.formatEscapedResult;
         ac.useShadow = true;
         ac.autoSnapContainer = true;
         ac.delimChar = e.getAttribute("autoCompleteDelimChar");

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.