PT-2025-5358 · Jenkins · Jenkins Eiffel Broadcaster Plugin+1

Magnus Bã¤Ck · Published 2025-01-22 · Updated 2025-10-03 · CVE-2025-24400

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Eiffel Broadcaster Plugin versions 2.8.0 through 2.10.2

Description The issue allows attackers to create a credential with the same ID as a legitimate one in a different credentials store, enabling them to sign an event published to RabbitMQ with the legitimate credentials. This is possible because the plugin uses the credential ID as the cache key during signing operations.

Recommendations For versions 2.8.0 through 2.10.2, consider updating to version 2.10.3, which removes the cache, thereby resolving the issue. As a temporary workaround, consider restricting access to the credential store to minimize the risk of exploitation.

Fix

Incorrect Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-863

CWE-276

Related Identifiers

CVE-2025-24400

GHSA-FPW7-8GJC-JWQJ

Affected Products

Jenkins

Jenkins Eiffel Broadcaster Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-fpw7-8gjc-jwqj · Vendor Advisory
• https://jenkins.io/security/advisory/2025-01-22/#SECURITY-3485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24400 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24400 · Vendor Advisory
• https://github.com/jenkinsci/eiffel-broadcaster-plugin · Note
• https://t.me/cvedetector/16131 · Telegram Post
• https://t.me/cveNotify/137266 · Telegram Post
• https://twitter.com/CVEnew/status/1882137389335986534 · Twitter Post