CVE-2025-67637: Jenkins: güvenlik açığı

Açıklama (NVD)

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Özet bilgiler

Ürün

Jenkins Jenkins

CVSS v3.1

4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

%0,18 (yüzdelik 8)

CWE

CWE-312

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• www.jenkins.io
• CWE-312