CVE-2025-67638
- State
- Published
- Severity
- 4.3 Medium
- Published
- Dec 10, 2025
- Updated
- Dec 10, 2025
- Reserved
- Dec 9, 2025
Description
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-312 Cleartext Storage of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
JenkinsJenkins Project |
|
References
- Jenkins Security Advisory 2025-12-10vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.