CVE-2025-64135
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-12-22

Assigner: Jenkins Project

Description
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-29
Last Modified
2025-12-22
Generated
2026-06-16
AI Q&A
2025-10-29
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64135
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jenkins eggplant_runner to 0.0.1.301.v963cffe8ddb_8 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in Jenkins Eggplant Runner Plugin version 0.0.1.301.v963cffe8ddb_8 and earlier, where the plugin sets the Java system property 'jdk.http.auth.tunneling.disabledSchemes' to an empty value. This action disables a protection mechanism in the Java runtime that is intended to prevent certain types of HTTP authentication tunneling attacks.

Impact Analysis

By disabling the Java runtime's protection mechanism against HTTP authentication tunneling, this vulnerability could allow an attacker to exploit HTTP authentication tunnels, potentially leading to unauthorized access or exposure of sensitive information. The CVSS score indicates a moderate impact with high confidentiality impact but no impact on integrity or availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64135. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart