GHSA-3jw2-5hjg-hc2c

ghsaUSosv

Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

view advisory published 2025-10-29Licence: CC-BY-4.0

Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to execute sandboxed Groovy code. As of publication of this advisory, there is no fix.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-64133US	—	0.26% (18th)	—	2025-10-29
A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/10/29/2WEB
https://github.com/jenkinsci/extensible-choice-parameter-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2025-64133ADVISORY
https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3583WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan