CVE-2017-2612: Jenkins

Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days.

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK.

Affected products

• Jenkins Jenkins: before 2.44 (fixed in 2.44); before 2.32.2 (fixed in 2.32.2)

Published 2018-05-15. Last modified 2026-06-17.