PT-2025-38153 · Cloudbees+2 · Jenkins+1

Manuel Fernandez · Published 2025-09-17 · Updated 2025-10-22 · CVE-2025-59476

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.527 and earlier Jenkins LTS versions 2.516.2 and earlier

Description Jenkins does not restrict or transform characters inserted from user-specified content in log messages. This allows attackers who can control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

Recommendations Update Jenkins to a version later than 2.527. Update Jenkins LTS to a version later than 2.516.2.

Fix

DoS

Improper Access Control

Special Elements Injection

RCE

Weakness Enumeration

CWE-284

CWE-74

CWE-117

CWE-20

Related Identifiers

BDU:2025-13362

BDU:2025-13363

BIT-JENKINS-2025-59476

CVE-2025-59476

GHSA-QRH5-JG98-CR48

Affected Products

Jenkins

Red Os

References · 13

• https://jenkins.io/security/advisory/2025-09-17/#SECURITY-3424 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59476 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13363 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59476 · Security Note
• https://bdu.fstec.ru/vul/2025-13362 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2025-59476 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrh5-jg98-cr48 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-jenkins-cve-2025-59476-cve-2025-59475/?sphrase_id=1328723 · Note
• https://jenkins.io/security/advisory/2025-09-17/#SECURITY-3625 · Note
• https://twitter.com/CVEnew/status/1968349162266837386 · Twitter Post
• http://openwall.com/lists/oss-security/2025/09/17/1 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-jenkins-cve-2025-59476-cve-2025-59475 · Note