CVE-2025-67636
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-17
Assigner: Jenkins Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jenkins | jenkins | to 2.528.3 (exc) |
| jenkins | jenkins | to 2.541 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a missing permission check in Jenkins versions 2.540 and earlier, including LTS 2.528.2 and earlier. It allows attackers who have View/Read permission to see encrypted password values in views, which they should not normally be able to access.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing unauthorized users with only View/Read permissions to access encrypted password values. This could lead to exposure of sensitive credentials, potentially enabling further unauthorized access or attacks within your Jenkins environment.