DeutschShown in its original language — a full translation is planned for a future version.
Jenkins Plugins: Mehrere Schwachstellen
view advisory published 2025-04-02
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen preiszugeben, Daten zu manipulieren und beliebigen Code auszuführen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-31728US | —OT elevated | — | ||
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe… | ||||
| CVE-2025-31727US | —OT elevated | — | ||
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users w… | ||||
| CVE-2025-31726US | —OT elevated | — | ||
Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Exte… | ||||
| CVE-2025-31725US | —OT elevated | — | ||
Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission… | ||||
| CVE-2025-31724US | —OT elevated | — | ||
Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can… | ||||
| CVE-2025-31723US | — | — | ||
A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order. | ||||
| CVE-2025-31722US | — | Exploit | ||
In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to exec… | ||||
| CVE-2025-31721US | —OT elevated | — | ||
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy… | ||||
| CVE-2025-31720US | —OT elevated | — | ||
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to c… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan