PT-2025-50356 · Cloudbees+2 · Jenkins+1

James Nord · Published 2025-12-10 · Updated 2025-12-23 · CVE-2025-67638

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.540 and earlier Jenkins LTS versions 2.528.2 and earlier

Description Jenkins does not mask build authorization tokens displayed on the job configuration form, potentially allowing attackers to observe and capture them.

Recommendations Update Jenkins to a version later than 2.540. Update Jenkins LTS to a version later than 2.528.2.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2025-15961

BIT-JENKINS-2025-67638

CVE-2025-67638

GHSA-HXJG-2JVF-H3RX

Affected Products

Jenkins

Red Os

References · 13

• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15961 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67638 · Security Note
• https://jenkins.io/security/advisory/2025-12-10/#SECURITY-783 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67638 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hxjg-2jvf-h3rx · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981 · Note
• https://t.me/cveNotify/146116 · Telegram Post
• https://t.me/CVEtracker/39379 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-jenkins-cve-2025-67638-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-jenkins-cve-2025-67638-8.0 · Note
• https://twitter.com/CVEnew/status/2000248626275401936 · Twitter Post