Medium WID-SEC-2025-2086 4 CVEs

Jenkins: Mehrere Schwachstellen

Published Sep 17, 2025 · Updated Sep 23, 2025 · Revision 2 · de-DE

Vendor: Jenkins Project Vendor: Red Hat Product: Enterprise Linux Product: Jenkins Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Dateien zu manipulieren.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 4

High 7.7

CVE-2025-5115

MadeYouReset HTTP/2 vulnerability

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state,…

Eclipse Jetty Eclipse Jetty trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Aug 20, 2025
Medium 5.3

CVE-2025-59474 Scanner template

Jenkins has a missing permission check, allowing users to obtain agent names

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins-2-openjdk-21 Web / CMS Wolfi Maven

Sep 17, 2025
Medium 5.3

CVE-2025-59476

Jenkins has a log message injection vulnerability

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followe…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins-2-openjdk-21 Web / CMS Wolfi Maven

Sep 17, 2025
Medium 4.3

CVE-2025-59475

Jenkins is missing a permission check in the authenticated users' profile menu

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listin…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core jenkins-2-openjdk-21 Web / CMS Wolfi Maven

Sep 17, 2025

Revision history

2025-09-23 #2
Neue Updates von Red Hat aufgenommen
2025-09-17 #1
Initiale Fassung

References

Jenkins Security Advisory 2025-09-17 vom 2025-09-17
https://www.jenkins.io/security/advisory/2025-09-17/
Red Hat Security Advisory RHSA-2025:16461 vom 2025-09-23
https://access.redhat.com/errata/RHSA-2025:16461