Cross-site Request Forgery (CSRF) Affecting org.jenkins-ci.plugins:themis package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGJENKINSCIPLUGINS-13774806
- published30 Oct 2025
- disclosed29 Oct 2025
- creditRomuald Moisan, Vincent Lardet
Introduced: 29 Oct 2025
NewCVE-2025-64136 (opens in a new tab)How to fix?
There is no fixed version for org.jenkins-ci.plugins:themis.
Overview
org.jenkins-ci.plugins:themis is an A Jenkins plugin to communicate with a Themis instance. It can send report files to be analyzed by Themis and send a refresh request for a project.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to a lack of permission check in an HTTP endpoint. An attacker with Overall/Read permission can connect to an attacker-specified URL. This endpoint also does not require POST requests, allowing exploitation by submitting crafted requests.