CVE-2017-1000504 (https://nvd.nist.gov/vuln/detail/CVE-2017-1000504): A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective. CVE-2017-1000503 (https://nvd.nist.gov/vuln/detail/CVE-2017-1000503): A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default. CVE-2017-1000392 (https://nvd.nist.gov/vuln/detail/CVE-2017-1000392): Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters. CVE-2017-1000391 (https://nvd.nist.gov/vuln/detail/CVE-2017-1000391): Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
*** Bug 641104 has been marked as a duplicate of this bug. ***
Vulnerable versions have been removed.
