Medium severity4.3NVD Advisory· Published Sep 3, 2025· Updated Jun 17, 2026
CVE-2025-58459
CVE-2025-58459
Description
Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:global-build-statsMaven | < 347.v32a | 347.v32a |
Affected products
2- Range: 0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-gm8g-fh49-qq6vghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-58459ghsaADVISORY
- www.jenkins.io/security/advisory/2025-09-03/nvdVendor AdvisoryWEB
- www.openwall.com/lists/oss-security/2025/09/03/4nvdWEB
- github.com/jenkinsci/global-build-stats-plugin/commit/32aeb0493c4ff5423448576f477ac612f7a25138ghsaWEB
News mentions
1- Jenkins Security Advisory 2025-09-03Jenkins Security Advisories · Sep 3, 2025