UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59475

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).

Severity
Medium 4.3
Published
17 Sept 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.516.3, 2.528
Sources
NVD

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version before 2.516.3
  • Every version before 2.528

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59475
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59475