CVE-2025-67639CWE-352csrf

CVE-2025-67639

Low · published December 10, 2025

CVSS v3.1

3.5

EPSS

Percentile

8.0

In the wild

Unconfirmed

What it is

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

The record

Technical detail

CVSS v3.1: 3.5 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00188 · 8.0th percentile
Weakness: CWE-352 · Cross-Site Request Forgery (CSRF)
Published: 2025-12-10T22:15Z

Affected products (2)

Product	Versions	Fixed in
jenkins/jenkins	< 2.528.3	2.528.3
jenkins/jenkins	< 2.541	2.541

References (1)

https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166 · [email protected]

EPSS history

Timeline

10 DEC 16:50Z
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the…
cvelistv5