Vulnerability Database

296,733

Total vulnerabilities in the database

CVE-2025-27624

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).

Published: Mar 6, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-27624
GHSA: GHSA-7g95-jmg9-h524
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CWEs:

CWE-352

Affected Software
References

Software	From	Fixed in
org.jenkins-ci.main / jenkins-core	2.493	2.500
org.jenkins-ci.main / jenkins-core	-	2.492.2
jenkins / jenkins	-	2.500
jenkins / jenkins	-	2.492.2

https://github.com/jenkinsci/jenkins/commit/84ef1a4d4db17d0ce66522d0141f6e52e2a4c97c
https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3498

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo