GHSA-6837-qgrc-x5p6

Jenkins has a CSRF vulnerability on the login form

En bref

Publiée: 2025-12-10 18:30 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2025-67639
Alias: BIT-jenkins-2025-67639
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Paquets affectés

Paquet	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 2.529, fixed 2.541
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 2.528.3

Références

https://nvd.nist.gov/vuln/detail/CVE-2025-67639 ADVISORY
https://github.com/jenkinsci/jenkins/commit/31598feb0aa514d8978d2c27a4c9a5a9b8d80a57 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database