CVE-2025-64135
BaseFortify
Publication date: 2025-10-29
Last updated on: 2025-12-22
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | eggplant_runner | to 0.0.1.301.v963cffe8ddb_8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Jenkins Eggplant Runner Plugin version 0.0.1.301.v963cffe8ddb_8 and earlier, where the plugin sets the Java system property 'jdk.http.auth.tunneling.disabledSchemes' to an empty value. This action disables a protection mechanism in the Java runtime that is intended to prevent certain types of HTTP authentication tunneling attacks.
How can this vulnerability impact me? :
By disabling the Java runtime's protection mechanism against HTTP authentication tunneling, this vulnerability could allow an attacker to exploit HTTP authentication tunnels, potentially leading to unauthorized access or exposure of sensitive information. The CVSS score indicates a moderate impact with high confidentiality impact but no impact on integrity or availability.