Jenkins
Jenkins Security Advisory 2025-12-10
2025-12-10 Dec 10, 2025 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2025-12-10/. 9 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2025-12-10/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
8 lines
Showing 1–8 of 8
CVE-2025-67635
BR2025-0000-008666
SECURITY-3630
unclaimed
Denial of service vulnerability in HTTP-based CLI
Credited as Camilo Vera Vidales (https://www.linkedin.com/in/camilo-vera-vidales/)
CVE-2025-67636
BR2025-0000-008667
SECURITY-1809
unclaimed
Missing permission check on password fields
Credited as Daniel Beck, CloudBees, Inc.
CVE-2025-67637
BR2025-0000-008668
SECURITY-783
unclaimed
Build authorization token stored and displayed in plain text
Credited as James Nord, CloudBees, Inc.
CVE-2025-67641
BR2025-0000-008669
SECURITY-3611
unclaimed
Stored XSS vulnerability in Coverage Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2025-67642
BR2025-0000-008670
SECURITY-3045
unclaimed
Exposure of system-scoped Vault credentials in HashiCorp Vault Plugin
Credited as Paul Walker, Ascension Health
CVE-2025-67643
BR2025-0000-008671
SECURITY-3290
unclaimed
Path traversal vulnerability in Redpen - Pipeline Reporter for Jira Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2025-13472
BR2025-0000-008672
SECURITY-3091
unclaimed
Missing permission check in BlazeMeter Plugin allows enumerating credentials IDs
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2025-13472
BR2025-0000-008673
SECURITY-3091
unclaimed
Missing permission check in BlazeMeter Plugin allows enumerating credentials IDs
Credited as Kevin Guerroudj, CloudBees, Inc.