Cross-site Request Forgery (CSRF) Affecting org.jenkins-ci.plugins:nexus-task-runner package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGJENKINSCIPLUGINS-13776366
- published30 Oct 2025
- disclosed29 Oct 2025
- creditAris ISSAD
Introduced: 29 Oct 2025
NewCVE-2025-64141 (opens in a new tab)How to fix?
There is no fixed version for org.jenkins-ci.plugins:nexus-task-runner.
Overview
org.jenkins-ci.plugins:nexus-task-runner is a This plugin executes Sonatype Nexus scheduled tasks after your build.
For example, if you want to refresh your Nexus's repositories index after building your project, you can use execute a Nexus task whose type is "Publish index" using this plugin.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the HTTP endpoint. An attacker with Overall/Read permission can cause unauthorized connections to arbitrary URLs with attacker-controlled credentials by sending crafted requests. This endpoint also does not require POST requests, allowing exploitation by submitting crafted requests.