PT-2025-14512 · Jenkins · Jenkins Templating Engine Plugin+1

Published 2025-04-02 · Updated 2025-04-29 · CVE-2025-31722

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Templating Engine Plugin versions 2.5.3 and earlier

Description The issue allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM, due to libraries defined in folders not being subject to sandbox protection.

Recommendations For Jenkins Templating Engine Plugin versions 2.5.3 and earlier, update to a version that includes the fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-03795

CVE-2025-31722

GHSA-4VJP-327P-W4QV

Affected Products

Jenkins

Jenkins Templating Engine Plugin

References · 16

• https://osv.dev/vulnerability/GHSA-4vjp-327p-w4qv · Vendor Advisory
• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3505 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-31722 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31722 · Security Note
• https://bdu.fstec.ru/vul/2025-03795 · Security Note
• https://github.com/jenkinsci/templating-engine-plugin/commit/bb2b4468b3bf4cea494afb8549af4e6450972653 · Note
• https://github.com/jenkinsci/templating-engine-plugin · Note
• https://twitter.com/syedaquib77/status/1907812416777499116 · Twitter Post
• https://twitter.com/dailycve/status/1917241502788444370 · Twitter Post
• https://t.me/cvetracker/20591 · Telegram Post
• https://t.me/cvenotify/120161 · Telegram Post
• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3513 · Note
• https://twitter.com/cracbot/status/1909199559617658901 · Twitter Post
• https://t.me/cvenotify/118021 · Telegram Post
• https://t.me/cvedetector/21881 · Telegram Post