Security readout for executives and security teams
Plain-English summary
Some Jenkins upgrades created a leftover backup folder containing old encrypted secrets and the key needed to read them. Because the backups were world-readable and not removed, anyone with file access to affected Jenkins home data or copied backups could potentially recover sensitive credentials.
Executive priority
Treat this as a credential exposure cleanup item for Jenkins estates, especially older or long-lived installations. It is not sourced as actively exploited, but exposed CI/CD credentials can affect source code, deployments, and production systems.
Technical view
CVE-2017-1000362 concerns Jenkins' re-key admin monitor, introduced in Jenkins 1.498. During secret re-encryption, it created $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups with old secrets and the encryption key. The source says Jenkins now deletes this directory and no longer creates it when upgrading from before 1.498.
Likely exposure
Exposure is most likely on Jenkins systems with historical upgrades from before Jenkins 1.498, or on manually created backups that preserved file permissions and include the re-key backup directory. The provided sources do not define exact affected release ranges beyond the 1.498 re-key behavior.
Exploitation context
The source bundle does not report active exploitation, and CISA KEV is false. This is primarily a sensitive-file exposure risk: attackers need access to Jenkins home files or backups, but that access could turn into credential disclosure.
Researcher notes
The evidence lacks CVSS, CWE, and complete affected-version metadata. Avoid treating this as a network-exploitable Jenkins bug based on the provided sources. Focus validation on filesystem artifacts, backup handling, permissions, and whether retained secrets were exposed.
Mitigation direction
- Upgrade Jenkins according to vendor guidance.
- Delete the re-key backup directory if present.
- Inspect manually created Jenkins backups for the backup directory.
- Restrict access to Jenkins home directories and backup stores.
- Rotate exposed credentials if the backup directory was accessible.
Validation and detection
- Check JENKINS_HOME for jenkins.security.RekeySecretAdminMonitor/backups.
- Search retained Jenkins backups for the same directory path.
- Review file permissions on Jenkins home and backup locations.
- Confirm Jenkins version and upgrade history with administrators.
- Assess whether exposed secrets require credential rotation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-1000362 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jenkins.io/security/advisory/2017-02-01/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.