PT-2025-9862 · Jenkins+1 · Jenkins+1

Xbow · Published 2025-03-05 · Updated 2025-06-24 · CVE-2025-27625

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.499 and earlier, LTS 2.492.1 and earlier

Description The issue allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site. This is because browsers interpret backslash (``) characters as part of scheme-relative redirects, and in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with these characters are considered safe.

Recommendations For Jenkins versions 2.499 and earlier, update to version 2.500 or later. For Jenkins LTS 2.492.1 and earlier, update to LTS 2.492.2 or later. As a temporary workaround, consider restricting access to URLs starting with backslash (``) characters to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-04959

BIT-JENKINS-2025-27625

CVE-2025-27625

GHSA-8HMV-92WM-39CH

Affected Products

Jenkins

Red Os

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-27625 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2025-27625 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27625 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8hmv-92wm-39ch · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04959 · Security Note
• https://jenkins.io/security/advisory/2025-03-05/#SECURITY-3501 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/4a9a3ecd08fc00d2f1c1125be789d8be24f02c9e · Note
• https://access.redhat.com/security/cve/CVE-2025-27625 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://twitter.com/dailycve/status/1937329982730084609 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1j5ofwu/jenkins_exposes_secrets_critical_vulnerabilities · Reddit Post
• https://t.me/cvedetector/19661 · Telegram Post
• https://twitter.com/CVEnew/status/1897506896602357930 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-jenkins-170425 · Note