CVE-2025-27624

mediumpriority · track · 0EPSS 0.004 · 38 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.44% (38th) EPSS

CVSS 5.4 · medium

Is it mine?

15 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondaryexploitability 2.8 · impact 2.5

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Lsecondary · OSV

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-352USCWE-352USCWE-352US

affected products (15)

Products and version ranges known to be affected.

Jenkins Jenkins <2.500all versionscert_bundDE
Jenkins Jenkins LTS <2.492.2all versionscert_bundDE
jenkins Jenkins≤ LTS <2.492.2cert_bundDE
jenkins Jenkins< 2.500cert_bundDE
Jenkins Project Jenkins< 2.492.2enisa_euvdEU
Jenkins Project Jenkins< 2.500enisa_euvdEU
CD Foundation Jenkins≤ 2.499fstec_bduRU
CD Foundation Jenkins≤ 2.492.1 LTSfstec_bduRU
Red Hat Inc. Red Hat Developer Huball versionsfstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
jenkins jenkins< 2.492.2nvdUScpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
jenkins jenkins< 2.500nvdUScpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
Bitnami jenkins2.493.0 → 2.504.1osvUSpkg:bitnami/jenkins
Maven org.jenkins-ci.main:jenkins-core< 2.492.2osvUSpkg:maven/org.jenkins-ci.main/jenkins-core
Maven org.jenkins-ci.main:jenkins-core2.493 → 2.500osvUSpkg:maven/org.jenkins-ci.main/jenkins-core

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0489Jenkins: Mehrere SchwachstellenDeutsch2025-03-05csaf · cert_bundDE
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen preiszugeben, Daten zu manipulieren und Spoofing-Angriffe durchzuführen.
GHSA-7g95-jmg9-h524Jenkins cross-site request forgery (CSRF) vulnerability2025-03-06ghsa · osvUS
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not require POST requests for the HTTP endpoint toggling collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets), resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets. Additionally, as the API accepts any string as the identifier of the panel ID to be toggled, attacker-controlled content can be stored in the victim’s user profile in Jenkins. Jenkins 2.500, LTS 2.492.2 requires POST requests for the affected HTTP endpoint.
BIT-jenkins-2025-276242025-03-07vendor · osvUS
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2025-03-05modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan