openwall.com
http://www.openwall.com/lists/oss-security/2025/09/17/1 CVE-2025-59474
MEDIUMNuclei
Jenkins has a missing permission check, allowing users to obtain agent names
Record summary
CVE-2025-59474 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.
Description
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Oct 17, 2025 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 25, 2025 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
jenkinsBrowse Jenkins / jenkins | VulnCheck | Version data not supplied | |
Default status: affected | CVE List | Before 2.387 | unaffected |
| 2.516.3 to < 2.516.* | unaffected | ||
| 2.528 to < * | unaffected | ||
org.jenkins-ci.main:jenkins-coreBrowse Maven / org.jenkins-ci.main:jenkins-core | GitHub Advisory | Before 2.516.3 · Fixed in 2.516.3 | affected |
| 2.517 to < 2.528 · Fixed in 2.528 | affected | ||
Nuclei templates
1ProjectDiscoveryMEDIUMJenkins Sidepanel - Unauthorized Agent/Queue Exposure
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
Impact
Attackers can list agent names without required permissions, potentially exposing sensitive infrastructure details.
Remediation
Update to a version later than 2.527 or LTS later than 2.516.2.
Authorsivaldivieso
Template tagscvecve2025jenkinssidepanelunauthvkevvuln
Shodan: product:"jenkins"
https://www.jenkins.io/security/advisory/2025-09-17/ https://nvd.nist.gov/vuln/detail/CVE-2025-59474 https://medium.com/@Th3hound/exposing-jenkins-agents-without-auth-research-on-cve-2025-59474-ff95a2e7d22a
Source: ProjectDiscovery
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-59474 Jenkins Security Advisory 2025-09-17Vendor advisory
https://www.jenkins.io/security/advisory/2025-09-17