forked from CVEProject/cvelistV5
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 4 new CVEs: CVE-2025-27622, CVE-2025-27623, CVE-2025-27624, CVE-2025-27625 - 1 updated CVEs: CVE-2024-9355
- Loading branch information
cvelistV5 Github Action
committed
Mar 5, 2025
1 parent
4b4a74a
commit 54445a5
Showing
5 changed files
with
252 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2025-27622", | ||
| "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "jenkins", | ||
| "dateReserved": "2025-03-04T07:21:12.533Z", | ||
| "datePublished": "2025-03-05T22:33:34.766Z", | ||
| "dateUpdated": "2025-03-05T22:33:34.766Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "providerMetadata": { | ||
| "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "shortName": "jenkins", | ||
| "dateUpdated": "2025-03-05T22:33:34.766Z" | ||
| }, | ||
| "affected": [ | ||
| { | ||
| "vendor": "Jenkins Project", | ||
| "product": "Jenkins", | ||
| "versions": [ | ||
| { | ||
| "version": "2.492.2", | ||
| "versionType": "maven", | ||
| "lessThan": "2.492.*", | ||
| "status": "unaffected" | ||
| }, | ||
| { | ||
| "version": "2.500", | ||
| "versionType": "maven", | ||
| "lessThan": "*", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "defaultStatus": "affected" | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets." | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "Jenkins Security Advisory 2025-03-05", | ||
| "url": "https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3495", | ||
| "tags": [ | ||
| "vendor-advisory" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2025-27623", | ||
| "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "jenkins", | ||
| "dateReserved": "2025-03-04T07:21:12.533Z", | ||
| "datePublished": "2025-03-05T22:33:35.469Z", | ||
| "dateUpdated": "2025-03-05T22:33:35.469Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "providerMetadata": { | ||
| "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "shortName": "jenkins", | ||
| "dateUpdated": "2025-03-05T22:33:35.469Z" | ||
| }, | ||
| "affected": [ | ||
| { | ||
| "vendor": "Jenkins Project", | ||
| "product": "Jenkins", | ||
| "versions": [ | ||
| { | ||
| "version": "2.492.2", | ||
| "versionType": "maven", | ||
| "lessThan": "2.492.*", | ||
| "status": "unaffected" | ||
| }, | ||
| { | ||
| "version": "2.500", | ||
| "versionType": "maven", | ||
| "lessThan": "*", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "defaultStatus": "affected" | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets." | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "Jenkins Security Advisory 2025-03-05", | ||
| "url": "https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3496", | ||
| "tags": [ | ||
| "vendor-advisory" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2025-27624", | ||
| "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "jenkins", | ||
| "dateReserved": "2025-03-04T07:21:12.533Z", | ||
| "datePublished": "2025-03-05T22:33:36.141Z", | ||
| "dateUpdated": "2025-03-05T22:33:36.141Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "providerMetadata": { | ||
| "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "shortName": "jenkins", | ||
| "dateUpdated": "2025-03-05T22:33:36.141Z" | ||
| }, | ||
| "affected": [ | ||
| { | ||
| "vendor": "Jenkins Project", | ||
| "product": "Jenkins", | ||
| "versions": [ | ||
| { | ||
| "version": "2.492.2", | ||
| "versionType": "maven", | ||
| "lessThan": "2.492.*", | ||
| "status": "unaffected" | ||
| }, | ||
| { | ||
| "version": "2.500", | ||
| "versionType": "maven", | ||
| "lessThan": "*", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "defaultStatus": "affected" | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets)." | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "Jenkins Security Advisory 2025-03-05", | ||
| "url": "https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3498", | ||
| "tags": [ | ||
| "vendor-advisory" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2025-27625", | ||
| "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "jenkins", | ||
| "dateReserved": "2025-03-04T07:21:12.534Z", | ||
| "datePublished": "2025-03-05T22:33:36.808Z", | ||
| "dateUpdated": "2025-03-05T22:33:36.808Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "providerMetadata": { | ||
| "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", | ||
| "shortName": "jenkins", | ||
| "dateUpdated": "2025-03-05T22:33:36.808Z" | ||
| }, | ||
| "affected": [ | ||
| { | ||
| "vendor": "Jenkins Project", | ||
| "product": "Jenkins", | ||
| "versions": [ | ||
| { | ||
| "version": "2.492.2", | ||
| "versionType": "maven", | ||
| "lessThan": "2.492.*", | ||
| "status": "unaffected" | ||
| }, | ||
| { | ||
| "version": "2.500", | ||
| "versionType": "maven", | ||
| "lessThan": "*", | ||
| "status": "unaffected" | ||
| } | ||
| ], | ||
| "defaultStatus": "affected" | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects." | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "Jenkins Security Advisory 2025-03-05", | ||
| "url": "https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3501", | ||
| "tags": [ | ||
| "vendor-advisory" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |