Vulnerability-Lookup

WID-SEC-W-2025-2443

Vulnerability from csaf_certbund - Published: 2025-10-29 23:00 - Updated: 2025-10-29 23:00

Summary

Jenkins Plugins: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und serverseitige Request-Forgery durchzuführen

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2025-64133

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64134

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64135

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64136

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64137

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64138

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64139

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64140

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64141

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64142

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64143

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64144

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64145

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64146

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64147

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64148

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64149

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64150

Affected products

Known affected 11 products

Product	Identifier	Version
Jenkins Jenkins JDepend Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:jdepend_plugin`	JDepend Plugin
Jenkins Jenkins Extensible ChoicParameter Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin`	Extensible ChoicParameter Plugin
Jenkins Jenkins Eggplant Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:eggplant_runner_plugin`	Eggplant Runner Plugin
Jenkins Jenkins Curseforge Publisher Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin`	Curseforge Publisher Plugin
Jenkins Jenkins Publish to Bitbucket Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin`	Publish to Bitbucket Plugin
Jenkins Jenkins OpenShift Pipeline Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin`	OpenShift Pipeline Plugin
Jenkins Jenkins Nexus Task Runner Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin`	Nexus Task Runner Plugin
Jenkins Jenkins ByteGuard Build Actions Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin`	ByteGuard Build Actions Plugin
Jenkins Jenkins azure-cli Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:azure-cli_plugin`	azure-cli Plugin
Jenkins Jenkins Themis Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:themis_plugin`	Themis Plugin
Jenkins Jenkins Start WindockContainers Plugin Jenkins / Jenkins	`cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin`	Start WindockContainers Plugin

CVE-2025-64132

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Jenkins Jenkins MCP Server Plugin <0.86.v7d3355e6a_a_18 Jenkins / Jenkins		MCP Server Plugin <0.86.v7d3355e6a_a_18

CVE-2025-64131

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Jenkins Jenkins SAML Plugin <4.583.585.v22ccc1139f55 Jenkins / Jenkins		SAML Plugin <4.583.585.v22ccc1139f55

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.jenkins.io/security/advisory/2025-10-29/	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterst\u00fctzung bei Softwareentwicklungen aller Art.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und serverseitige Request-Forgery durchzuf\u00fchren",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2443 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2443.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2443 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2443"
      },
      {
        "category": "external",
        "summary": "Jenkins Security Advisory vom 2025-10-29",
        "url": "https://www.jenkins.io/security/advisory/2025-10-29/"
      }
    ],
    "source_lang": "en-US",
    "title": "Jenkins Plugins: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-10-29T23:00:00.000+00:00",
      "generator": {
        "date": "2025-10-30T09:38:26.452+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-2443",
      "initial_release_date": "2025-10-29T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-10-29T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "MCP Server Plugin \u003c0.86.v7d3355e6a_a_18",
                "product": {
                  "name": "Jenkins Jenkins MCP Server Plugin \u003c0.86.v7d3355e6a_a_18",
                  "product_id": "T048199"
                }
              },
              {
                "category": "product_version",
                "name": "MCP Server Plugin 0.86.v7d3355e6a_a_18",
                "product": {
                  "name": "Jenkins Jenkins MCP Server Plugin 0.86.v7d3355e6a_a_18",
                  "product_id": "T048199-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:mcp_server_plugin__0.86.v7d3355e6a_a_18"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "SAML Plugin \u003c4.583.585.v22ccc1139f55",
                "product": {
                  "name": "Jenkins Jenkins SAML Plugin \u003c4.583.585.v22ccc1139f55",
                  "product_id": "T048203"
                }
              },
              {
                "category": "product_version",
                "name": "SAML Plugin 4.583.585.v22ccc1139f55",
                "product": {
                  "name": "Jenkins Jenkins SAML Plugin 4.583.585.v22ccc1139f55",
                  "product_id": "T048203-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:saml_plugin__4.583.585.v22ccc1139f55"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "azure-cli Plugin",
                "product": {
                  "name": "Jenkins Jenkins azure-cli Plugin",
                  "product_id": "T048204",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:azure-cli_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ByteGuard Build Actions Plugin",
                "product": {
                  "name": "Jenkins Jenkins ByteGuard Build Actions Plugin",
                  "product_id": "T048205",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:byteguard_build_actions_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Curseforge Publisher Plugin",
                "product": {
                  "name": "Jenkins Jenkins Curseforge Publisher Plugin",
                  "product_id": "T048206",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:curseforge_publisher_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Eggplant Runner Plugin",
                "product": {
                  "name": "Jenkins Jenkins Eggplant Runner Plugin",
                  "product_id": "T048207",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:eggplant_runner_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Extensible ChoicParameter Plugin",
                "product": {
                  "name": "Jenkins Jenkins Extensible ChoicParameter Plugin",
                  "product_id": "T048208",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:extensible_choicparameter_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "JDepend Plugin",
                "product": {
                  "name": "Jenkins Jenkins JDepend Plugin",
                  "product_id": "T048209",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:jdepend_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Nexus Task Runner Plugin",
                "product": {
                  "name": "Jenkins Jenkins Nexus Task Runner Plugin",
                  "product_id": "T048210",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:nexus_task_runner_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "OpenShift Pipeline Plugin",
                "product": {
                  "name": "Jenkins Jenkins OpenShift Pipeline Plugin",
                  "product_id": "T048211",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:openshift_pipeline_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Publish to Bitbucket Plugin",
                "product": {
                  "name": "Jenkins Jenkins Publish to Bitbucket Plugin",
                  "product_id": "T048212",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:publish_to_bitbucket_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Start WindockContainers Plugin",
                "product": {
                  "name": "Jenkins Jenkins Start WindockContainers Plugin",
                  "product_id": "T048213",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:start_windockcontainers_plugin"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Themis Plugin",
                "product": {
                  "name": "Jenkins Jenkins Themis Plugin",
                  "product_id": "T048214",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudbees:jenkins:themis_plugin"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Jenkins"
          }
        ],
        "category": "vendor",
        "name": "Jenkins"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64133",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64133"
    },
    {
      "cve": "CVE-2025-64134",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64134"
    },
    {
      "cve": "CVE-2025-64135",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64135"
    },
    {
      "cve": "CVE-2025-64136",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64136"
    },
    {
      "cve": "CVE-2025-64137",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64137"
    },
    {
      "cve": "CVE-2025-64138",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64138"
    },
    {
      "cve": "CVE-2025-64139",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64139"
    },
    {
      "cve": "CVE-2025-64140",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64140"
    },
    {
      "cve": "CVE-2025-64141",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64141"
    },
    {
      "cve": "CVE-2025-64142",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64142"
    },
    {
      "cve": "CVE-2025-64143",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64143"
    },
    {
      "cve": "CVE-2025-64144",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64144"
    },
    {
      "cve": "CVE-2025-64145",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64145"
    },
    {
      "cve": "CVE-2025-64146",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64146"
    },
    {
      "cve": "CVE-2025-64147",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64147"
    },
    {
      "cve": "CVE-2025-64148",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64148"
    },
    {
      "cve": "CVE-2025-64149",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64149"
    },
    {
      "cve": "CVE-2025-64150",
      "product_status": {
        "known_affected": [
          "T048209",
          "T048208",
          "T048207",
          "T048206",
          "T048212",
          "T048211",
          "T048210",
          "T048205",
          "T048204",
          "T048214",
          "T048213"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64150"
    },
    {
      "cve": "CVE-2025-64132",
      "product_status": {
        "known_affected": [
          "T048199"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64132"
    },
    {
      "cve": "CVE-2025-64131",
      "product_status": {
        "known_affected": [
          "T048203"
        ]
      },
      "release_date": "2025-10-29T23:00:00.000+00:00",
      "title": "CVE-2025-64131"
    }
  ]
}

CVE-2025-64131 (GCVE-0-2025-64131)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-294 - Authentication Bypass by Capture-replay

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins SAML Plugin	Affected: 0 , ≤ 4.583.vc68232f7018a_ (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64131",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T14:04:43.474270Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-294",
                "description": "CWE-294 Authentication Bypass by Capture-replay",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T14:04:46.309Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:22.397Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins SAML Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "4.583.vc68232f7018a_",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user\u0027s web browser and Jenkins to replay those requests, authenticating to Jenkins as that user."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:39.724Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3613"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64131",
    "datePublished": "2025-10-29T13:29:39.724Z",
    "dateReserved": "2025-10-28T07:34:37.541Z",
    "dateUpdated": "2025-11-04T21:14:22.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64132 (GCVE-0-2025-64132)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins MCP Server Plugin	Affected: 0 , ≤ 0.84.v50ca_24ef83f2 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64132",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T14:05:29.975005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T14:05:33.219Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:23.718Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jenkins MCP Server Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "0.84.v50ca_24ef83f2",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:40.401Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3622"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64132",
    "datePublished": "2025-10-29T13:29:40.401Z",
    "dateReserved": "2025-10-28T07:34:37.541Z",
    "dateUpdated": "2025-11-04T21:14:23.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64133 (GCVE-0-2025-64133)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Extensible Choice Parameter Plugin	Affected: 0 , ≤ 239.v5f5c278708cf (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64133",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T14:06:26.938246Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T14:06:29.266Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:25.010Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Extensible Choice Parameter Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "239.v5f5c278708cf",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:41.045Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3583"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64133",
    "datePublished": "2025-10-29T13:29:41.045Z",
    "dateReserved": "2025-10-28T07:34:37.541Z",
    "dateUpdated": "2025-11-04T21:14:25.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64134 (GCVE-0-2025-64134)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins JDepend Plugin	Affected: 0 , ≤ 1.3.1 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64134",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T14:08:28.762874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-611",
                "description": "CWE-611 Improper Restriction of XML External Entity Reference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T14:08:30.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:26.342Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins JDepend Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:41.699Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64134",
    "datePublished": "2025-10-29T13:29:41.699Z",
    "dateReserved": "2025-10-28T07:34:37.541Z",
    "dateUpdated": "2025-11-04T21:14:26.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64135 (GCVE-0-2025-64135)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1188 - Initialization of a Resource with an Insecure Default

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Eggplant Runner Plugin	Affected: 0 , ≤ 0.0.1.301.v963cffe8ddb_8 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64135",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T14:10:14.601172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1188",
                "description": "CWE-1188 Initialization of a Resource with an Insecure Default",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T14:10:17.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:27.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Eggplant Runner Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "0.0.1.301.v963cffe8ddb_8",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:42.358Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3326"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64135",
    "datePublished": "2025-10-29T13:29:42.358Z",
    "dateReserved": "2025-10-28T07:34:37.542Z",
    "dateUpdated": "2025-11-04T21:14:27.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64136 (GCVE-0-2025-64136)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Themis Plugin	Affected: 0 , ≤ 1.4.1 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64136",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T13:56:00.175641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T13:56:03.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:29.011Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Themis Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:42.998Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64136",
    "datePublished": "2025-10-29T13:29:42.998Z",
    "dateReserved": "2025-10-28T07:34:37.542Z",
    "dateUpdated": "2025-11-04T21:14:29.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64137 (GCVE-0-2025-64137)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Themis Plugin	Affected: 0 , ≤ 1.4.1 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T13:54:55.522032Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T13:55:06.059Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:30.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Themis Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:43.669Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64137",
    "datePublished": "2025-10-29T13:29:43.669Z",
    "dateReserved": "2025-10-28T07:34:37.542Z",
    "dateUpdated": "2025-11-04T21:14:30.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64138 (GCVE-0-2025-64138)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Start Windocks Containers Plugin	Affected: 0 , ≤ 1.4 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64138",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T13:56:43.487641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-352",
                "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T13:56:45.751Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:31.752Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Start Windocks Containers Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.4",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:44.349Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64138",
    "datePublished": "2025-10-29T13:29:44.349Z",
    "dateReserved": "2025-10-28T07:34:37.542Z",
    "dateUpdated": "2025-11-04T21:14:31.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64139 (GCVE-0-2025-64139)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Start Windocks Containers Plugin	Affected: 0 , ≤ 1.4 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T13:57:11.116751Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T13:57:13.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:33.120Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Start Windocks Containers Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "1.4",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:45.114Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64139",
    "datePublished": "2025-10-29T13:29:45.114Z",
    "dateReserved": "2025-10-28T07:34:37.542Z",
    "dateUpdated": "2025-11-04T21:14:33.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64140 (GCVE-0-2025-64140)

Vulnerability from cvelistv5 – Published: 2025-10-29 13:29 – Updated: 2025-11-04 21:14

Summary

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

jenkins

References

2 references

URL	Tags
https://www.jenkins.io/security/advisory/2025-10-…	vendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Impacted products

1 product

Vendor	Product	Version
Jenkins Project	Jenkins Azure CLI Plugin	Affected: 0 , ≤ 0.9 (maven)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-64140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-29T13:58:05.249345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-29T13:58:07.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:34.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/29/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Jenkins Azure CLI Plugin",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThanOrEqual": "0.9",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-29T13:29:45.804Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2025-10-29",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3538"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2025-64140",
    "datePublished": "2025-10-29T13:29:45.804Z",
    "dateReserved": "2025-10-28T07:34:37.542Z",
    "dateUpdated": "2025-11-04T21:14:34.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-2443

CVE-2025-64131 (GCVE-0-2025-64131)

CVE-2025-64132 (GCVE-0-2025-64132)

CVE-2025-64133 (GCVE-0-2025-64133)

CVE-2025-64134 (GCVE-0-2025-64134)

CVE-2025-64135 (GCVE-0-2025-64135)

CVE-2025-64136 (GCVE-0-2025-64136)

CVE-2025-64137 (GCVE-0-2025-64137)

CVE-2025-64138 (GCVE-0-2025-64138)

CVE-2025-64139 (GCVE-0-2025-64139)

CVE-2025-64140 (GCVE-0-2025-64140)

Tags

Sightings

Nomenclature