CVE-2025-59476
Jenkins Project Jenkins
MEDIUM 5.3
At a glance
- Source
- NVD
- EPSS
- EPSS 0.38 % · percentile 32 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- jenkins
- NVD status
- Modified
Description
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Weaknesses (CWE)
- CWE-117 — Improper Output Neutralization for Logs
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-qrh5-jg98-cr48 — Jenkins has a log message injection vulnerability
European references
- ENISA EUVD · EUVD-2025-29721
- GCVE · GCVE-0-2025-59476
Affected configurations (NVD CPE)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*< 2.516.3cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*< 2.528
Affected products
| Product | Versions |
|---|---|
| Jenkins Project · Jenkins | unaffected 2.516.3 < 2.516.* ; unaffected 2.528 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |