Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Advisory: Jenkins — Jenkins Security Advisory 2025-03-05 Clear all filters
TI-2025-20431 CVE-2025-27625 · GHSA-8hmv-92wm-39ch

Open redirect in Jenkins

Priority LOW 21

In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00624 Published 2025-03-05 Partial fix · 2.492.2, 2.500 CWE-601
TI-2025-20430 CVE-2025-27624 · GHSA-7g95-jmg9-h524

Cross-site request forgery in Jenkins

Priority LOW 25

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Bu…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00441 Published 2025-03-05 Fixed in 2.492.2, 2.500 CWE-352
TI-2025-20429 CVE-2025-27623 · GHSA-rfh6-9r2q-98vf

Cleartext storage of sensitive information in Jenkins

Priority LOW 20

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted valu…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00341 Published 2025-03-05 Partial fix · 2.492.2, 2.500 CWE-312
TI-2025-20428 CVE-2025-27622 · GHSA-p34j-r3ch-c985

Cleartext storage of sensitive information in Jenkins

Priority LOW 21

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view enc…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00781 Published 2025-03-05 Partial fix · 2.492.2, 2.500 CWE-312