High severity8.1NVD Advisory· Published Jan 24, 2018· Updated Jun 17, 2026

CVE-2017-1000504

Description

A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-coreMaven	>= 2.81, < 2.89.2	2.89.2
org.jenkins-ci.main:jenkins-coreMaven	>= 2.90, < 2.95	2.95

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.main/jenkins-core
Range: >= 2.81, < 2.89.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-99hj-ppg3-2xwcghsaADVISORY
jenkins.io/security/advisory/2017-12-14/nvdVendor Advisory
nvd.nist.gov/vuln/detail/CVE-2017-1000504ghsaADVISORY
github.com/jenkinsci/jenkins/commit/ccc374a7176d7704941fb494589790b7673efe2ghsaWEB
jenkins.io/security/advisory/2017-12-14ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000