This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Jenkins fixes 4 vulnerabilities
Jenkins fixes 4 vulnerabilities with versions 2.500 (weekly release) and 2.492.2 (LTS release) [1].
An authenticated remote attacker with the Agent/Extended Read permission (in the agent configuration) or View/Read permission (in the view configuration) can read encrypted Secrets values in config.xml via the REST API or CLI [1][2].
The vulnerability is present in products:
- *:Jenkins weekly;<=2.499;
- *:Jenkins LTS;<=2.492.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-27622 at cve.org, NVD
- CVE-2025-27623 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2025.
Using social engineering, an unauthenticated remote attacker can perform a CSRF attack [1].
The vulnerability is present in products:
- *:Jenkins weekly;<=2.499;
- *:Jenkins LTS;<=2.492.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
More information:
- CVE-2025-27624 at cve.org, NVD
- CWE-352: Cross-Site Request Forgery (CSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2025.
Using social engineering and a specially crafted URL, an unauthenticated remote attacker can redirect the victim to a potentially malicious page [1].
The vulnerability is present in products:
- *:Jenkins weekly;<=2.499;
- *:Jenkins LTS;<=2.492.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
More information:
- CVE-2025-27625 at cve.org, NVD
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect') at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 6. 3. 2025.