This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Jenkins warns of 8 vulnerabilities in plugins

Jenkins warns of 8 vulnerabilities in its plugins. The most severe of them are described below; the rest can be found at [1]. Plugins and their fixed versions (if available) [1][2]: Azure Service Fabric Plugin - no fix available at the time of publication Bitbucket Server Integration Plugin - 4.1.4 Eiffel Broadcaster Plugin - 2.10.3 Folder-based Authorization Strategy Plugin - no fix available at the time of publication GitLab Plugin - 1.9.7 OpenId Connect Authentication Plugin - 4.453.v4d7765c854f4 Zoom Plugin - 1.6

Jenkins Bitbucket Server Integration Plugin - CSRF (CVE-2025-24398)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker, due to insufficient restrictions in the Bitbucket Server Integration Plugin implementation supporting OAuth 1.0 authentication, to perform a CSRF attack using social engineering [1].

The vulnerability is present in product:

  • *:Bitbucket Server Integration Plugin;>=2.1.0,<=4.1.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 22. 1. 2025.

Jenkins OpenId Connect Authentication Plugin - privilege escalation (CVE-2025-24399)
CVSS 8.8 (High)

Allows an authenticated remote attacker, due to case-insensitive handling in the OpenId Connect Authentication Plugin, to log in as any user and potentially gain administrator privileges. Jenkins instances configured to use a case-sensitive OpenID Connect (OIDC) provider are vulnerable. To remove the vulnerability, in addition to updating to the fixed version, it is necessary to explicitly enable case sensitivity in the plugin settings [1].

The vulnerability is present in product:

  • *:OpenId Connect Authentication Plugin;<4.438.440.v3f5f201de5dc;>4.438.440.v3f5f201de5dc,<=4.452.v2849b_d3945fa_

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 22. 1. 2025.

Jenkins Folder-based Authorization Strategy Plugin - unauthorised access (CVE-2025-24401)
CVSS 6.8 (Medium)

Allows an authenticated remote attacker, due to insufficient verification of granted permissions (typically optional ones such as Overall/Manage) in the Folder-based Authorization Strategy Plugin, to gain unauthorized access to some functionalities [1]. A fix for the vulnerability is not available at the time of publication [1][2].

The vulnerability is present in product:

  • *:Folder-based Authorization Strategy Plugin;<=217.vd5b_18537403e

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

More information:

The vulnerability was publicly disclosed 22. 1. 2025.

Jenkins GitLab Plugin - credential ID enumeration (CVE-2025-24397)
CVSS 4.3 (Medium)

Allows an authenticated remote attacker who has the global Item/Configure permission, but does not have it for any specific job, to obtain the identifiers of stored credentials of the API token and Secret text types due to insufficient permission checks in the GitLab Plugin, which may, in combination with another vulnerability, potentially be abused to obtain the credentials [1].

The vulnerability is present in product:

  • *:GitLab Plugin;<=1.9.6

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 22. 1. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 27. 1. 2025.

CESNET, z.s.p.o. Logo