PT-2025-44289 · Jenkins · Jenkins Azure Cli Plugin+1

Said Abdesslem Messadi · Published 2025-10-29 · Updated 2025-12-22 · CVE-2025-64140

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Azure CLI Plugin versions 0.9 and earlier

Description The Jenkins Azure CLI Plugin does not restrict the commands it executes on the Jenkins controller. This allows attackers with Item/Configure permission to execute arbitrary shell commands. The issue arises from a lack of command validation, enabling malicious actors to run commands on the Jenkins master node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-64140

GHSA-RH72-238F-G26Q

Affected Products

Jenkins

Jenkins Azure Cli Plugin

References · 11

• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-3538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64140 · Security Note
• https://osv.dev/vulnerability/GHSA-rh72-238f-g26q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64140 · Vendor Advisory
• https://github.com/jenkinsci/azure-cli-plugin · Note
• https://t.me/cveNotify/146532 · Telegram Post
• https://twitter.com/CVEnew/status/1983530921606406277 · Twitter Post
• https://t.me/CVEtracker/36062 · Telegram Post
• http://openwall.com/lists/oss-security/2025/10/29/2 · Note
• https://twitter.com/CveTodo/status/1983544071051207089 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1983546313867243612 · Twitter Post