PT-2025-5359 · Jenkins · Jenkins Folder-Based Authorization Strategy Plugin+1

Yaroslav Afenkin · Published 2025-01-22 · Updated 2025-10-03 · CVE-2025-24401

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jenkins Folder-based Authorization Strategy Plugin versions 217.vd5b 18537403e and earlier

Description The issue potentially allows users who were formerly granted certain permissions to access functionality they are no longer entitled to, because the plugin does not verify that the configured permissions are enabled. This typically involves optional permissions.

Recommendations For Jenkins Folder-based Authorization Strategy Plugin versions 217.vd5b 18537403e and earlier, as a temporary workaround, consider reviewing and manually validating the permissions configured for each user to ensure they align with the intended access levels, until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-24401

GHSA-969G-RQ57-C79H

Affected Products

Jenkins

Jenkins Folder-Based Authorization Strategy Plugin

References · 8

• https://jenkins.io/security/advisory/2025-01-22/#SECURITY-3062 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-969g-rq57-c79h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24401 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24401 · Vendor Advisory
• https://github.com/jenkinsci/folder-auth-plugin · Note
• https://twitter.com/CVEnew/status/1882137387981283806 · Twitter Post
• https://t.me/cveNotify/137267 · Telegram Post
• https://t.me/cvedetector/16123 · Telegram Post