CVE-2025-27623

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-27623

Severity

4.3

Medium

CVSS CVSS_V3

Description

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.

References

https://images.chainguard.dev/security/CGA-59f3-jgh3-33wg
https://github.com/advisories/GHSA-rfh6-9r2q-98vf
https://images.chainguard.dev/security/CGA-jfjg-q7fp-4hqv
https://images.chainguard.dev/security/CGA-rcj2-68vc-393x
https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3496

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CVE-2025-27623

Severity

Description

References

Affected packages

Product

Solutions

Customers

Resources

Company