DeutschShown in its original language — a full translation is planned for a future version.
Jenkins Plugins: Mehrere Schwachstellen
view advisory published 2025-01-22
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder erhöhte Rechte zu erlangen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-0142US | —OT elevated | — | ||
Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via netw… | ||||
| CVE-2025-24403US | —OT elevated | — | ||
A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials st… | ||||
| CVE-2025-24402US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specifie… | ||||
| CVE-2025-24401US | —OT elevated | — | ||
Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users… | ||||
| CVE-2025-24400US | —OT elevated | — | ||
Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a crede… | ||||
| CVE-2025-24399US | —OT elevated | — | ||
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins… | ||||
| CVE-2025-24398US | — | — | ||
Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. | ||||
| CVE-2025-24397US | —OT elevated | — | ||
An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any part… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan