CVE-2025-27624

MEDIUM

Jenkins < 2.492.2, 2.493-2.499 - Cross-Site Request Forgery

Title source: llm

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3498

Scores

CVSS v3 5.4

EPSS 0.0016

EPSS Percentile 36.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (3)

jenkins/jenkins < 2.492.2

jenkins/jenkins < 2.500

org.jenkins-ci.main/jenkins-core 2.493 - 2.500Maven

Published Mar 05, 2025

Tracked Since Feb 18, 2026