Vulnerability-Lookup

WID-SEC-W-2025-2819

Vulnerability from csaf_certbund - Published: 2025-12-10 23:00 - Updated: 2025-12-10 23:00

Summary

Jenkins: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen offenzulegen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Cross-Site-Scripting-Angriffe durchzuführen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2025-13472

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Jenkins Jenkins BlazeMeter Plugin <4.27 Jenkins / Jenkins		BlazeMeter Plugin <4.27

CVE-2025-67635

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Jenkins weekly <2.541 Jenkins / Jenkins		Jenkins weekly <2.541
Jenkins Jenkins Jenkins LTS <2.528.3 Jenkins / Jenkins		Jenkins LTS <2.528.3

CVE-2025-67636

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Jenkins weekly <2.541 Jenkins / Jenkins		Jenkins weekly <2.541
Jenkins Jenkins Jenkins LTS <2.528.3 Jenkins / Jenkins		Jenkins LTS <2.528.3

CVE-2025-67637

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Jenkins weekly <2.541 Jenkins / Jenkins		Jenkins weekly <2.541
Jenkins Jenkins Jenkins LTS <2.528.3 Jenkins / Jenkins		Jenkins LTS <2.528.3

CVE-2025-67638

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Jenkins weekly <2.541 Jenkins / Jenkins		Jenkins weekly <2.541
Jenkins Jenkins Jenkins LTS <2.528.3 Jenkins / Jenkins		Jenkins LTS <2.528.3

CVE-2025-67639

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Jenkins Jenkins Jenkins weekly <2.541 Jenkins / Jenkins		Jenkins weekly <2.541
Jenkins Jenkins Jenkins LTS <2.528.3 Jenkins / Jenkins		Jenkins LTS <2.528.3

CVE-2025-67640

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Jenkins Jenkins Git client Plugin <6.4.1 Jenkins / Jenkins		Git client Plugin <6.4.1

CVE-2025-67641

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Jenkins Jenkins Coverage Plugin <2.3056.v1dfe888b_0249 Jenkins / Jenkins		Coverage Plugin <2.3056.v1dfe888b_0249

CVE-2025-67642

Affected products

Last affected 1 product

Product	Identifier	Version	Remediation
Jenkins Jenkins HashiCorp Vault Plugin <=371.v884a_4dd60fb_6 Jenkins / Jenkins		HashiCorp Vault Plugin <=371.v884a_4dd60fb_6

CVE-2025-67643

Affected products

Last affected 1 product

Product	Identifier	Version	Remediation
Jenkins Jenkins Redpen-Pipeline Reporter for Jira Plugin <=1.054.v7b_9517b_6b_202 Jenkins / Jenkins		Redpen-Pipeline Reporter for Jira Plugin <=1.054.v7b_9517b_6b_202

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.jenkins.io/security/advisory/2025-12-10/	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterst\u00fctzung bei Softwareentwicklungen aller Art.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen offenzulegen, beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren, Sicherheitsma\u00dfnahmen zu umgehen oder Cross-Site-Scripting-Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2819 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2819.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2819 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2819"
      },
      {
        "category": "external",
        "summary": "Jenkins Security Advisory vom 2025-12-10",
        "url": "https://www.jenkins.io/security/advisory/2025-12-10/"
      }
    ],
    "source_lang": "en-US",
    "title": "Jenkins: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-12-10T23:00:00.000+00:00",
      "generator": {
        "date": "2025-12-11T12:10:09.986+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-2819",
      "initial_release_date": "2025-12-10T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-12-10T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Jenkins weekly \u003c2.541",
                "product": {
                  "name": "Jenkins Jenkins Jenkins weekly \u003c2.541",
                  "product_id": "T049330"
                }
              },
              {
                "category": "product_version",
                "name": "Jenkins weekly 2.541",
                "product": {
                  "name": "Jenkins Jenkins Jenkins weekly 2.541",
                  "product_id": "T049330-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:jenkins_weekly__2.541"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Jenkins LTS \u003c2.528.3",
                "product": {
                  "name": "Jenkins Jenkins Jenkins LTS \u003c2.528.3",
                  "product_id": "T049331"
                }
              },
              {
                "category": "product_version",
                "name": "Jenkins LTS 2.528.3",
                "product": {
                  "name": "Jenkins Jenkins Jenkins LTS 2.528.3",
                  "product_id": "T049331-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:jenkins_lts__2.528.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Coverage Plugin \u003c2.3056.v1dfe888b_0249",
                "product": {
                  "name": "Jenkins Jenkins Coverage Plugin \u003c2.3056.v1dfe888b_0249",
                  "product_id": "T049333"
                }
              },
              {
                "category": "product_version",
                "name": "Coverage Plugin 2.3056.v1dfe888b_0249",
                "product": {
                  "name": "Jenkins Jenkins Coverage Plugin 2.3056.v1dfe888b_0249",
                  "product_id": "T049333-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:coverage_plugin__2.3056.v1dfe888b_0249"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "BlazeMeter Plugin \u003c4.27",
                "product": {
                  "name": "Jenkins Jenkins BlazeMeter Plugin \u003c4.27",
                  "product_id": "T049334"
                }
              },
              {
                "category": "product_version",
                "name": "BlazeMeter Plugin 4.27",
                "product": {
                  "name": "Jenkins Jenkins BlazeMeter Plugin 4.27",
                  "product_id": "T049334-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:blazemeter_plugin__4.27"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Git client Plugin \u003c6.4.1",
                "product": {
                  "name": "Jenkins Jenkins Git client Plugin \u003c6.4.1",
                  "product_id": "T049335"
                }
              },
              {
                "category": "product_version",
                "name": "Git client Plugin 6.4.1",
                "product": {
                  "name": "Jenkins Jenkins Git client Plugin 6.4.1",
                  "product_id": "T049335-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:git_client_plugin__6.4.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "HashiCorp Vault Plugin \u003c=371.v884a_4dd60fb_6",
                "product": {
                  "name": "Jenkins Jenkins HashiCorp Vault Plugin \u003c=371.v884a_4dd60fb_6",
                  "product_id": "T049338"
                }
              },
              {
                "category": "product_version_range",
                "name": "HashiCorp Vault Plugin \u003c=371.v884a_4dd60fb_6",
                "product": {
                  "name": "Jenkins Jenkins HashiCorp Vault Plugin \u003c=371.v884a_4dd60fb_6",
                  "product_id": "T049338-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "Redpen-Pipeline Reporter for Jira Plugin \u003c=1.054.v7b_9517b_6b_202",
                "product": {
                  "name": "Jenkins Jenkins Redpen-Pipeline Reporter for Jira Plugin \u003c=1.054.v7b_9517b_6b_202",
                  "product_id": "T049339"
                }
              },
              {
                "category": "product_version_range",
                "name": "Redpen-Pipeline Reporter for Jira Plugin \u003c=1.054.v7b_9517b_6b_202",
                "product": {
                  "name": "Jenkins Jenkins Redpen-Pipeline Reporter for Jira Plugin \u003c=1.054.v7b_9517b_6b_202",
                  "product_id": "T049339-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "Jenkins"
          }
        ],
        "category": "vendor",
        "name": "Jenkins"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13472",
      "product_status": {
        "known_affected": [
          "T049334"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-13472"
    },
    {
      "cve": "CVE-2025-67635",
      "product_status": {
        "known_affected": [
          "T049330",
          "T049331"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67635"
    },
    {
      "cve": "CVE-2025-67636",
      "product_status": {
        "known_affected": [
          "T049330",
          "T049331"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67636"
    },
    {
      "cve": "CVE-2025-67637",
      "product_status": {
        "known_affected": [
          "T049330",
          "T049331"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67637"
    },
    {
      "cve": "CVE-2025-67638",
      "product_status": {
        "known_affected": [
          "T049330",
          "T049331"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67638"
    },
    {
      "cve": "CVE-2025-67639",
      "product_status": {
        "known_affected": [
          "T049330",
          "T049331"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67639"
    },
    {
      "cve": "CVE-2025-67640",
      "product_status": {
        "known_affected": [
          "T049335"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67640"
    },
    {
      "cve": "CVE-2025-67641",
      "product_status": {
        "known_affected": [
          "T049333"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67641"
    },
    {
      "cve": "CVE-2025-67642",
      "product_status": {
        "last_affected": [
          "T049338"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67642"
    },
    {
      "cve": "CVE-2025-67643",
      "product_status": {
        "last_affected": [
          "T049339"
        ]
      },
      "release_date": "2025-12-10T23:00:00.000+00:00",
      "title": "CVE-2025-67643"
    }
  ]
}

CVE-2025-13472 (GCVE-0-2025-13472)

Vulnerability from cvelistv5 – Published: 2025-12-03 08:42 – Updated: 2025-12-03 14:21

Title

Missing authorization in BlazeMeter Jenkins Plugin

Summary

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

Perforce

References

1 reference

URL	Tags
https://portal.perforce.com/s/cve/a91Qi000002bFgT…

Impacted products

1 product

Vendor	Product	Version
Perforce	BlazeMeter	Affected: 0 , < 4.27 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13472",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-03T14:21:08.551306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-03T14:21:10.953Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Jenkins Plugin"
          ],
          "product": "BlazeMeter",
          "vendor": "Perforce",
          "versions": [
            {
              "lessThan": "4.27",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI."
            }
          ],
          "value": "A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-03T08:45:26.835Z",
        "orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
        "shortName": "Perforce"
      },
      "references": [
        {
          "url": "https://portal.perforce.com/s/cve/a91Qi000002bFgTIAU/missing-authorization-in-blazemeter-jenkins-plugin"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing authorization in BlazeMeter Jenkins Plugin",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
    "assignerShortName": "Perforce",
    "cveId": "CVE-2025-13472",
    "datePublished": "2025-12-03T08:42:27.305Z",
    "dateReserved": "2025-11-20T11:26:48.612Z",
    "dateUpdated": "2025-12-03T14:21:10.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67635 (GCVE-0-2025-67635)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-16 13:36

Summary

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-404 - Improper Resource Shutdown or Release

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.541 , < * (maven) Unaffected: 2.528.3 , < 2.528.* (maven)

Credits

Camilo Vera Vidales (https://www.linkedin.com/in/camilo-vera-vidales/)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:51.868670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-404",
                "description": "CWE-404 Improper Resource Shutdown or Release",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:35:17.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Camilo Vera Vidales (https://www.linkedin.com/in/camilo-vera-vidales/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T13:36:56.086Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67635",
    "datePublished": "2025-12-10T16:50:35.491Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-16T13:36:56.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67636 (GCVE-0-2025-67636)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:36

Summary

A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.541 , < * (maven) Unaffected: 2.528.3 , < 2.528.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:36:48.563369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:36:51.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:36.239Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1809"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67636",
    "datePublished": "2025-12-10T16:50:36.239Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:36:51.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67637 (GCVE-0-2025-67637)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:33

Summary

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.541 , < * (maven) Unaffected: 2.528.3 , < 2.528.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:28.070858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:33:30.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:36.942Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67637",
    "datePublished": "2025-12-10T16:50:36.942Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:33:30.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67638 (GCVE-0-2025-67638)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:33

Summary

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.541 , < * (maven) Unaffected: 2.528.3 , < 2.528.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:33:12.151344Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-312",
                "description": "CWE-312 Cleartext Storage of Sensitive Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:33:14.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:37.570Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67638",
    "datePublished": "2025-12-10T16:50:37.570Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:33:14.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67639 (GCVE-0-2025-67639)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:27

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins	Unaffected: 2.541 , < * (maven) Unaffected: 2.528.3 , < 2.528.* (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.5,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67639",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:27:23.050997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:27:25.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.541",
              "versionType": "maven"
            },
            {
              "lessThan": "2.528.*",
              "status": "unaffected",
              "version": "2.528.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker\u0027s account."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:38.218Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67639",
    "datePublished": "2025-12-10T16:50:38.218Z",
    "dateReserved": "2025-12-09T17:33:01.215Z",
    "dateUpdated": "2025-12-10T17:27:25.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67640 (GCVE-0-2025-67640)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:26

Summary

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Git client Plugin	Affected: 0 , ≤ 6.4.0 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67640",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:26:10.565594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:26:12.968Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins Git client Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "6.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:38.792Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3614"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67640",
    "datePublished": "2025-12-10T16:50:38.792Z",
    "dateReserved": "2025-12-09T17:33:01.216Z",
    "dateUpdated": "2025-12-10T17:26:12.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67641 (GCVE-0-2025-67641)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 18:16

Summary

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Coverage Plugin	Affected: 0 , ≤ 2.3054.ve1ff7b_a_a_123b_ (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67641",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T18:15:31.692866Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T18:16:02.206Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins Coverage Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "2.3054.ve1ff7b_a_a_123b_",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:39.402Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3611"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67641",
    "datePublished": "2025-12-10T16:50:39.402Z",
    "dateReserved": "2025-12-09T17:33:01.216Z",
    "dateUpdated": "2025-12-10T18:16:02.206Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67642 (GCVE-0-2025-67642)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:23

Summary

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-282 - Improper Ownership Management

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins HashiCorp Vault Plugin	Affected: 0 , ≤ 371.v884a_4dd60fb_6 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67642",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:22:53.528640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-282",
                "description": "CWE-282 Improper Ownership Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:23:56.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins HashiCorp Vault Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "371.v884a_4dd60fb_6",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:40.020Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3045"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67642",
    "datePublished": "2025-12-10T16:50:40.020Z",
    "dateReserved": "2025-12-09T17:33:01.216Z",
    "dateUpdated": "2025-12-10T17:23:56.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-67643 (GCVE-0-2025-67643)

Vulnerability from cvelistv5 – Published: 2025-12-10 16:50 – Updated: 2025-12-10 17:20

Summary

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

jenkins

References

1 reference

URL	Tags
https://www.jenkins.io/security/advisory/2025-12-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Redpen - Pipeline Reporter for Jira Plugin	Affected: 0 , ≤ 1.054.v7b_9517b_6b_202 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-67643",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-10T17:19:48.347302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-10T17:20:12.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Redpen - Pipeline Reporter for Jira Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.054.v7b_9517b_6b_202",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T16:50:40.604Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-12-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3290"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-67643",
    "datePublished": "2025-12-10T16:50:40.604Z",
    "dateReserved": "2025-12-09T17:33:01.216Z",
    "dateUpdated": "2025-12-10T17:20:12.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-2819

CVE-2025-13472 (GCVE-0-2025-13472)

CVE-2025-67635 (GCVE-0-2025-67635)

CVE-2025-67636 (GCVE-0-2025-67636)

CVE-2025-67637 (GCVE-0-2025-67637)

CVE-2025-67638 (GCVE-0-2025-67638)

CVE-2025-67639 (GCVE-0-2025-67639)

CVE-2025-67640 (GCVE-0-2025-67640)

CVE-2025-67641 (GCVE-0-2025-67641)

CVE-2025-67642 (GCVE-0-2025-67642)

CVE-2025-67643 (GCVE-0-2025-67643)

Tags

Sightings

Nomenclature