CVE-2025-67636

mediumpriority · track · 0OT risk · elevatedEPSS 0.002 · 16 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.25% (16th) EPSS

CVSS 4.3 · medium

Is it mine?

16 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondaryexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · OSV

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-862USCWE-862USCWE-862US

affected products (16)

Products and version ranges known to be affected.

Jenkins Jenkins Jenkins LTS <2.528.3all versionscert_bundDE
Jenkins Jenkins Jenkins weekly <2.541all versionscert_bundDE
jenkins Jenkins≤ Jenkins LTS <2.528.3cert_bundDE
jenkins Jenkins≤ Jenkins weekly <2.541cert_bundDE
Jenkins Project Jenkins< 2.528.3enisa_euvdEU
Jenkins Project Jenkins< 2.541enisa_euvdEU
CD Foundation Jenkins≤ 2.541fstec_bduRU
CD Foundation Jenkins≤ LTS 2.528.3fstec_bduRU
Red Hat Inc. OpenShift Developer Tools and Servicesall versionsfstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
jenkins jenkins< 2.528.3nvdUScpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
jenkins jenkins< 2.541nvdUScpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
Bitnami jenkins< 2.528.3osvUSpkg:bitnami/jenkins
Bitnami jenkins2.529.0 → 2.541.0osvUSpkg:bitnami/jenkins
Maven org.jenkins-ci.main:jenkins-core< 2.528.3osvUSpkg:maven/org.jenkins-ci.main/jenkins-core
Maven org.jenkins-ci.main:jenkins-core2.529 → 2.541osvUSpkg:maven/org.jenkins-ci.main/jenkins-core

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2819Jenkins: Mehrere SchwachstellenDeutsch2025-12-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen offenzulegen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Cross-Site-Scripting-Angriffe durchzuführen.
GHSA-p3f5-98cv-562jJenkins is missing a permission check on password fields2025-12-10ghsa · osvUS
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
BIT-jenkins-2025-676362025-12-12vendor · osvUS
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2025-12-10modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan