PT-2025-36621 · Maven · Org.Jenkins-Ci.Plugins:Global-Build-Stats

Published 2025-09-03 · Updated 2025-09-03

OSV

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins global-build-stats Plugin 322.v22f4db 18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.

This has been patched in version 347.v32a eb 0493c4f.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

GHSA-GM8G-FH49-QQ6V

Affected Products

Org.Jenkins-Ci.Plugins:Global-Build-Stats

References · 5

• https://osv.dev/vulnerability/GHSA-gm8g-fh49-qq6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58459 · Security Note
• https://github.com/jenkinsci/global-build-stats-plugin/commit/32aeb0493c4ff5423448576f477ac612f7a25138 · Note
• https://github.com/jenkinsci/global-build-stats-plugin · Note
• https://jenkins.io/security/advisory/2025-09-03/#SECURITY-3535 · Note