Jenkins
Jenkins Security Advisory 2025-05-14
2025-05-14 May 14, 2025 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2025-05-14/. 5 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2025-05-14/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
5 lines
Showing 1–5 of 5
CVE-2025-47885
BR2025-0000-008834
SECURITY-3559
unclaimed
Stored XSS vulnerability in Health Advisor by CloudBees Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2025-47884
BR2025-0000-008835
SECURITY-3574
unclaimed
Insufficient validation of claims in OpenID Connect Provider Plugin
Credited as Jesse Glick, CloudBees, Inc.
CVE-2025-47889
BR2025-0000-008836
SECURITY-3481
unclaimed
Authentication bypass vulnerability in WSO2 Oauth Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2025-47888
BR2025-0000-008837
SECURITY-3353
unclaimed
SSL/TLS certificate validation unconditionally disabled by DingTalk Plugin
Credited as Pierre Beitz, CloudBees, Inc.
CVE-2025-47886
BR2025-0000-008838
SECURITY-3548
unclaimed
CSRF vulnerability and missing permission checks in Cadence vManager Plugin
Credited as Vincent Lardet