/
DirectorySecurity Advisories
Sign In
Security Advisories

CVE-2025-31720

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-31720

CGA ID

CGA-gv6p-56vg-6274

Severity

Unknown

Summary

Jenkins Missing Permission Check

Description

Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.

Jenkins 2.504, LTS 2.492.3 requires Computer/Extended Read permission to copy an agent.

References

  • https://images.chainguard.dev/security/CGA-gv6p-56vg-6274
  • https://github.com/advisories/GHSA-565r-pf5q-45v6
  • https://nvd.nist.gov/vuln/detail/CVE-2025-31720
  • https://github.com/jenkinsci/jenkins/commit/bf32018bf075c06e5df649583557c82d42d8bb5c
  • https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3512

Affected packages

Safe Source for Open Source™
Media KitContact Us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Products

Chainguard ContainersChainguard LibrariesChainguard VMs

Why Chainguard

Container Image SecurityVulnerability RemediationCompliance and Risk MitigationSoftware Supply Chain SecurityAI/ML Security

Customers

Customer StoriesChainguard Love

Company

About UsPricingContact UsOpen SourceCareersNewsroomLegal

Resources

Unchained BlogEventsTrust CenterDocumentation