CVE-2025-27622

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-27622

Severity

4.3

Medium

CVSS CVSS_V3

Description

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.

References

https://images.chainguard.dev/security/CGA-7r54-7793-crqp
https://github.com/advisories/GHSA-p34j-r3ch-c985
https://images.chainguard.dev/security/CGA-ffrh-hqc9-r8px
https://images.chainguard.dev/security/CGA-mh22-fv95-vcvp
https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3495

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CVE-2025-27622

Severity

Description

References

Affected packages

Product

Solutions

Customers

Resources

Company