Permissions, Privileges, and Access Controls in Jenkins and Jenkins LTS - CVE-2025-31721

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU106932

Permissions, Privileges, and Access Controls in Jenkins and Jenkins LTS - CVE-2025-31721

Published: April 3, 2025


Vulnerability identifier: #VU106932
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-31721
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper permission check in an HTTP endpoint. A remote user can copy an agent to gain access to encrypted secrets in its configuration.


Affected software

Jenkins
Jenkins LTS
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Automated Test Suite

How to mitigate CVE-2025-31721

Install updates from vendor's website.

Jenkins - update to 2.504
Jenkins LTS - update to 2.492.3
Oracle Communications Cloud Native Core Unified Data Repository - update to 23.4.1
Oracle Communications Cloud Native Core Binding Support Function - update to 24.2.3

External References

Related Security Bulletins