High WID-SEC-2025-1052 6 CVEs

Jenkins Plugins: Mehrere Schwachstellen

Published May 14, 2025 · Updated May 14, 2025 · de-DE

Vendor: Jenkins Project Product: Jenkins Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Jenkins-Plugins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 6

Critical 9.8

CVE-2025-47889

Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, …

Jenkins Project Jenkins WSO2 Oauth Plugin org.jenkins-ci.plugins:wso2id-oauth Web / CMS Maven

May 14, 2025
Critical 9.1

CVE-2025-47884

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft …

Jenkins Project Jenkins OpenID Connect Provider Plugin io.jenkins.plugins:oidc-provider Web / CMS Maven

May 14, 2025
High 8.8

CVE-2025-47885

Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting

Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health …

Jenkins Project Jenkins Health Advisor by CloudBees Plugin org.jenkins-ci.plugins:cloudbees-jenkins-advisor Web / CMS Maven

May 14, 2025
Medium 5.9

CVE-2025-47888

Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation

Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.

Jenkins Project Jenkins DingTalk Plugin io.jenkins.plugins:dingding-notifications Web / CMS Maven

May 14, 2025
Medium 4.3

CVE-2025-47886

Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery

A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.

Jenkins Project Jenkins Cadence vManager Plugin org.jenkins-ci.plugins:vmanager-plugin Web / CMS Maven

May 14, 2025
Medium 4.3

CVE-2025-47887

Jenkins Cadence vManager Plugin is Missing Permission Checks

Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Jenkins Project Jenkins Cadence vManager Plugin org.jenkins-ci.plugins:vmanager-plugin Web / CMS Maven

May 14, 2025

Revision history

2025-05-14 #1
Initiale Fassung

References

Jenkins Security Advisory vom 2025-05-14
https://www.jenkins.io/security/advisory/2025-05-14/