Threat Intelligence Database

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Jenkins versions 2.567 and earlier, including LTS 2.555.2 and earlier, contain a vulnerability where the software improperly validates redirect URLs after login if they include relative path segments such as './' or '../'. This flaw can be exploited by attackers to conduct phishing attacks by redirecting users to malicious sites disguised as legitimate Jenkins URLs. The vulnerability is classified as CWE-601 (Open Redirect). The CVSS v3.1 base score is 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.

MediumVulnerabilityGermanyUnited KingdomFrance+3#cve#cve-2025-67636