CVE-2025-64137

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

20th percentile - higher than 20% of all known CVEs

Summary

A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

Risk Assessment

An attacker with Overall/Read permission can connect to an external server, potentially leading to data leakage or using the Jenkins server for further attacks. This may compromise the security of the CI/CD infrastructure.

Recommendation

Update the Jenkins Themis Plugin to a version later than 1.4.1 if available. Restrict Overall/Read permissions to trusted users.

Other vulnerabilities in Jenkins Themis Plugin

CVE-2025-64136Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.

Original NVD description (English source)

A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS