PT-2025-50355 · Cloudbees+2 · Jenkins+1

James Nord · Published 2025-12-10 · Updated 2025-12-23 · CVE-2025-67637

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.540 and earlier Jenkins LTS versions 2.528.2 and earlier

Description Jenkins stores build authorization tokens unencrypted in config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission, or access to the Jenkins controller file system, to view these tokens.

Recommendations Update Jenkins to a version later than 2.540. Update Jenkins LTS to a version later than 2.528.2.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2025-15960

BIT-JENKINS-2025-67637

CVE-2025-67637

GHSA-FXJ7-6V9W-XC76

Affected Products

Jenkins

Red Os

References · 13

• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67637 · Security Note
• https://jenkins.io/security/advisory/2025-12-10/#SECURITY-783 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxj7-6v9w-xc76 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15960 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67637 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981 · Note
• https://t.me/cveNotify/146115 · Telegram Post
• https://twitter.com/CVEnew/status/2000248627453899202 · Twitter Post
• https://t.me/CVEtracker/39378 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-jenkins-cve-2025-67637-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-jenkins-cve-2025-67637-8.0 · Note