Moderate severityNVD Advisory· Published Apr 2, 2025· Updated Apr 2, 2025
CVE-2025-31721
CVE-2025-31721
Description
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | >= 2.500, < 2.504 | 2.504 |
org.jenkins-ci.main:jenkins-coreMaven | < 2.492.3 | 2.492.3 |
Affected products
10- osv-coords9 versionspkg:apk/chainguard/jenkins-2.479pkg:apk/chainguard/jenkins-2.479-compatpkg:apk/chainguard/jenkins-2.479-remotingpkg:apk/chainguard/jenkins-2.492pkg:apk/wolfi/jenkins-2.479pkg:apk/wolfi/jenkins-2.479-compatpkg:apk/wolfi/jenkins-2.479-remotingpkg:bitnami/jenkinspkg:maven/org.jenkins-ci.main/jenkins-core
< 0+ 8 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.492.3-r4
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.492.3
- (no CPE)range: >= 2.500, < 2.504
- Range: 2.492.3
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-wr6w-jxg7-qpfhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-31721ghsaADVISORY
- www.jenkins.io/security/advisory/2025-04-02/ghsavendor-advisoryWEB
- github.com/jenkinsci/jenkins/commit/b3651b475302e8dba20fc63c1ff89d144ec652f0ghsaWEB
News mentions
1- Jenkins Security Advisory 2025-04-02Jenkins Security Advisories · Apr 2, 2025