Missing Authorization Affecting io.jenkins.plugins:opentelemetry package, versions [,3.1543.1545.vf5a_4ec123769)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IOJENKINSPLUGINS-12670798
- published14 Sept 2025
- disclosed3 Sept 2025
- creditDaniel Beck, Kevin Guerroudj
Introduced: 3 Sep 2025
CVE-2025-58460 (opens in a new tab)How to fix?
Upgrade io.jenkins.plugins:opentelemetry to version 3.1543.1545.vf5a_4ec123769 or higher.
Overview
io.jenkins.plugins:opentelemetry is a Monitor and observe Jenkins with OpenTelemetry.
Affected versions of this package are vulnerable to Missing Authorization due to the absence of a required permission check in the method implementing form validation. An attacker can access sensitive credential information by connecting to a URL of their choice using credentials IDs they have obtained through other means.