Moole Vulnerability Database

Find real vulnerabilities before they ship

Low

CVE-2025-67639

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

VectorNETWORK

PublishedDec 10, 2025, 17:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score3.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.main:jenkins-core(Maven)2.5292.541N/A

org.jenkins-ci.main:jenkins-core(Maven)02.528.3N/A

References

https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166

Weakness Type

CWE-352

CVSS Metrics

Base Score

3.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Base SeverityLow

Version

3.1

Attack Vector (AV)

NETWORK