What’s Vulnerable › Vulnerabilities
CVE-2017-1000401
- Severity: low (CVSS 2.2 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-01-26 · updated 2026-06-17
- Weakness: CWE-20
Description
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for <f:password/> is now always sent via POST, which is typically not logged.
Affected products
- Jenkins: through 2.73.1; through 2.83
References
Get alerted when CVE-2017-1000401 or the next vulnerability affects your stack