CVE-2025-59476
Jenkins Project Jenkins
MEDIUM 5.3
En bref
- Source
- NVD
- EPSS
- EPSS 0.38 % · centile 32 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- jenkins
- Statut NVD
- Modified
Description
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Faiblesses (CWE)
- CWE-117 — Neutralisation incorrecte des sorties de journalisation
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-qrh5-jg98-cr48 — Jenkins has a log message injection vulnerability
Références européennes
- ENISA EUVD · EUVD-2025-29721
- GCVE · GCVE-0-2025-59476
Configurations affectées (CPE NVD)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*< 2.516.3cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*< 2.528
Produits affectés
| Produit | Versions |
|---|---|
| Jenkins Project · Jenkins | unaffected 2.516.3 < 2.516.* ; unaffected 2.528 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |