CVE-2025-64139

MediumCVSS 4.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check, allowing attackers with Overall/Read permission to connect to an attacker-specified URL.

Risk Assessment

A low-privileged attacker can abuse the Jenkins server to make requests to arbitrary URLs, potentially resulting in information leakage or access to internal resources.

Recommendation

Upgrade Jenkins Start Windocks Containers Plugin to a version newer than 1.4. Restrict Overall/Read permission to the minimum necessary.

Other vulnerabilities in Jenkins Start Windocks Containers Plugin

CVE-2025-64138Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.

Original NVD description (English source)

A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS