Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6cw8-67c2-1ugk
Vulnerability ID VCID-6cw8-67c2-1ugk
Aliases CVE-2017-2606
GHSA-6967-9vvv-4cmm
Summary Information Exposure Jenkins is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible. This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an `UnprotectedRootAction`.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-2606.json
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
epss 0.00081 https://api.first.org/data/v1/epss?cve=CVE-2017-2606
cvssv3.1 4.3 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2606
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2606
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-6967-9vvv-4cmm
cvssv3.1 4.3 https://github.com/jenkinsci/jenkins
generic_textual MODERATE https://github.com/jenkinsci/jenkins
cvssv3.1 4.3 https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51266b63719
generic_textual MODERATE https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51266b63719
cvssv3.1 4.3 https://jenkins.io/security/advisory/2017-02-01
generic_textual MODERATE https://jenkins.io/security/advisory/2017-02-01
cvssv2 4.0 https://nvd.nist.gov/vuln/detail/CVE-2017-2606
cvssv3 4.3 https://nvd.nist.gov/vuln/detail/CVE-2017-2606
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2017-2606
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2017-2606
cvssv3.1 4.3 http://www.securityfocus.com/bid/95962
generic_textual MODERATE http://www.securityfocus.com/bid/95962
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-2606.json
https://api.first.org/data/v1/epss?cve=CVE-2017-2606
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2606
https://github.com/jenkinsci/jenkins
https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51266b63719
https://jenkins.io/security/advisory/2017-02-01
https://jenkins.io/security/advisory/2017-02-01/
http://www.securityfocus.com/bid/95962
1418717 https://bugzilla.redhat.com/show_bug.cgi?id=1418717
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
CVE-2017-2606 https://nvd.nist.gov/vuln/detail/CVE-2017-2606
GHSA-6967-9vvv-4cmm https://github.com/advisories/GHSA-6967-9vvv-4cmm
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-2606.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2606
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/jenkins
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51266b63719
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://jenkins.io/security/advisory/2017-02-01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-2606
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-2606
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2017-2606
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://www.securityfocus.com/bid/95962
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.23864
EPSS Score 0.00081
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:47:40.054886+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.main/jenkins-core/CVE-2017-2606.yml 38.0.0