CVE-2025-59474: jenkins Missing Authorization
CVSS: 5.3v3.1MediumModified
AliasesCGA-2h36-7wvq-fxf3CGA-492m-fw7p-m6c6CGA-5cg5-x5rv-xwqwCGA-76qm-rq89-j9rvCGA-7xh7-4vrv-3g7gCGA-9ghv-ppv4-v8jgCGA-g5j6-prqj-j747CGA-gr7x-77pm-5fvmCGA-h5cx-r49f-gpfhCGA-p58h-95cc-gvc7CGA-q9cq-qccq-hqrfCGA-v8wf-hw56-987hCGA-vrxh-gwfp-4m8hCGA-x82r-4grg-6776CGA-2g8f-6vcc-5j83CGA-64xw-gpgc-436jCGA-7456-mw9r-m6rhCGA-cm3h-cfx8-hmj7CGA-gr7f-q46c-2434CGA-jjpc-qq2p-7fxpCGA-mj22-qw72-455qGHSA-67v4-38h7-9jjpBIT-jenkins-2025-59474CGA-qmp5-cjg2-7gw4
Published 17-09-2025Last modified 04-11-2025
Vulnerability summary
CVE-2025-59474 is a medium (CVSS 5.3) Missing Authorization vulnerability in jenkins. EPSS estimates a 4.91% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
4.91%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 17-09-2025PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
4.91%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.91% on 18-09-2026
18-09-202618-10-2026
EPSS score4.91%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard11 products
- jenkins-2< 2.528-r0
- jenkins-2-openjdk-17< 2.528-r0
- jenkins-2-openjdk-21< 2.528-r0
- jenkins-2.504-openjdk-17All versions (No fix recorded)
- jenkins-2.504-openjdk-21All versions (No fix recorded)
Wolfi7 products
- jenkins-2< 2.528-r0
- jenkins-2-openjdk-17< 2.528-r0
- jenkins-2-openjdk-21< 2.528-r0
- jenkins-compat< 2.528-r0
- jenkins-docker-agent-openjdk-21< 2.528-r0
Jenkins1 product
- jenkins< 2.516.3 | < 2.528
Org.jenkins-ci.main1 product
- jenkins-core< 2.516.3 | ≥ 2.517, < 2.528
4 vendors · 20 products
