Maven Org.jenkins-ci.main:jenkins-core vulnerabilities

CVE-2025-67639 Low · 3.5 CWE-352 Dec 10, 2025

Jenkins has a CSRF vulnerability on the login form

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

CVE-2025-67638 Medium · 4.3 CWE-312 Dec 10, 2025

Jenkins's build authorization token is stored and displayed in plain text

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

CVE-2025-67637 Medium · 4.3 CWE-312 Dec 10, 2025

Jenkins's build authorization token is stored and displayed in plain text

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

CVE-2025-67636 Medium · 4.3 CWE-862 Dec 10, 2025

Jenkins is missing a permission check on password fields

A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

CVE-2025-67635 High · 7.5 CWE-404 Dec 10, 2025

Jenkins has a Denial of service vulnerability in HTTP-based CLI

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

CVE-2024-23897 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Jan 24, 2024

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

CVE-2018-1000861 Critical · 9.8 KEV Urgent · 79 Public exploit CWE-502 Dec 10, 2018

Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

CVE-2017-1000353 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-502 Jan 29, 2018

Jenkins Remote Code Execution Vulnerability

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.

CVE-2015-5317 High · 7.5 KEV High · 59 CWE-200 Nov 25, 2015

Jenkins User Interface (UI) Information Disclosure Vulnerability

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.