Moderate severityNVD Advisory· Published Apr 2, 2025· Updated Apr 2, 2025
CVE-2025-31720
CVE-2025-31720
Description
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | >= 2.500, < 2.504 | 2.504 |
org.jenkins-ci.main:jenkins-coreMaven | < 2.492.3 | 2.492.3 |
Affected products
11- osv-coords10 versionspkg:apk/chainguard/jenkins-2.462pkg:apk/chainguard/jenkins-2.479pkg:apk/chainguard/jenkins-2.479-compatpkg:apk/chainguard/jenkins-2.479-remotingpkg:apk/chainguard/jenkins-2.492pkg:apk/wolfi/jenkins-2.479pkg:apk/wolfi/jenkins-2.479-compatpkg:apk/wolfi/jenkins-2.479-remotingpkg:bitnami/jenkinspkg:maven/org.jenkins-ci.main/jenkins-core
< 0+ 9 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.492.3-r4
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.492.3
- (no CPE)range: >= 2.500, < 2.504
- Range: 2.492.3
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-565r-pf5q-45v6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-31720ghsaADVISORY
- www.jenkins.io/security/advisory/2025-04-02/ghsavendor-advisoryWEB
- github.com/jenkinsci/jenkins/commit/bf32018bf075c06e5df649583557c82d42d8bb5cghsaWEB
News mentions
1- Jenkins Security Advisory 2025-04-02Jenkins Security Advisories · Apr 2, 2025