BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-12-22

Assigner: Jenkins Project

Description

Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-12-22

Generated

2026-07-06

AI Q&A

2025-10-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64135

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	eggplant_runner	to 0.0.1.301.v963cffe8ddb_8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in Jenkins Eggplant Runner Plugin version 0.0.1.301.v963cffe8ddb_8 and earlier, where the plugin sets the Java system property 'jdk.http.auth.tunneling.disabledSchemes' to an empty value. This action disables a protection mechanism in the Java runtime that is intended to prevent certain types of HTTP authentication tunneling attacks.

Impact Analysis

By disabling the Java runtime's protection mechanism against HTTP authentication tunneling, this vulnerability could allow an attacker to exploit HTTP authentication tunnels, potentially leading to unauthorized access or exposure of sensitive information. The CVSS score indicates a moderate impact with high confidentiality impact but no impact on integrity or availability.

Hi! I’m here to help you understand CVE-2025-64135. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70