CVE-2017-1000398

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.73.1 and earlier, 2.83 and earlier

Description The remote API in Jenkins at the /computer/(agent-name)/api endpoint showed information about tasks currently running on an agent, including tasks that the current user otherwise had no access to due to lack of Item/Read permission.

Recommendations For Jenkins versions 2.73.1 and earlier, 2.83 and earlier, update to a version that includes the fix for this issue to restrict the API from showing information about inaccessible tasks. As a temporary workaround, consider restricting access to the /computer/(agent-name)/api endpoint until a patch is available.